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Foreword 



rd , 



This Technical Specification has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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Scope 



The present document defines the interface between the Subscriber Identity Module (SIM) and the Mobile Equipment 
(ME) for use during the network operation phase of GSM as well as those aspects of the internal organization of the 
SIM which are related to the network operation phase. This is to ensure interoperability between a SIM and an ME 
independently of the respective manufacturers and operators. The concept of a split of the Mobile Station (MS) into 
these elements as well as the distinction between the GSM network operation phase, which is also called GSM 
operations, and the administrative management phase are described in the TS 02.17 [6]. 

The present document defines: 

the requirements for the physical characteristics of the SIM, the electrical signals and the transmission protocols; 

the model which shall be used as a basis for the design of the logical structure of the SIM; 

the security features; 

the interface functions; 

the commands; 

the contents of the files required for the GSM application; 

- the application protocol. 

Unless otherwise stated, references to GSM also apply to DCS 1800 and PCS 1900. 

The present document does not specify any aspects related to the administrative management phase. Any internal 
technical reallocation of either the SIM or the ME are only specified where these reflect over the interface. It does not 
specify any of the security algorithms which may be used. 

The present document defines the SIM/ME interface for GSM Phase 2. While all attempts have been made to maintain 
phase compatibility, any issues that specifically relate to Phase 1 should be referenced from within the relevant Phase 1 
specification. 
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The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 
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[2] 3GPP TR 21.905: "Vocabulary for 3GPP Specifications". 

[3] 3GPP TS 02.07: "Mobile Stations (MS) features". 
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[17] GSM 09.91: "Digital cellular telecommunications system (Phase 2); Interworking aspects of the 

Subscriber Identity Module - Mobile Equipment (SIM - ME) interface between Phase 1 and 
Phase 2". 

[18] ITU-T Recommendation E. 1 18: "The international telecommunication charge card". 

[19] ITU-T Recommendation E. 164: "The international public telecommunication numbering plan". 

[20] ITU-T Recommendation T.50: "International Reference Alphabet (IRA) (Formerly International 

Alphabet No. 5 or IA5) - Information technology - 7-bit coded character set for information 
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[21] ISO/IEC 7810 (1995): "Identification cards - Physical characteristics". 
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Physical characteristics". 
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Electronic signals and transmission protocols". 
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- Mobile Equipment (SIM - ME) interface". 

[28] GSM 11.12: "Digital cellular telecommunications system (Phase 2); Specification of the 3 Volt 
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3 Definitions, abbreviations and symbols 

3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply: 

access conditions: set of security attributes associated with a file 

application: application consists of a set of security mechanisms, files, data and protocols (excluding transmission 
protocols) 

application protocol: set of procedures required by the application 
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card session: link between the card and the external world starting with the ATR and ending with a subsequent reset or 
a deactivation of the card 

current directory: latest MF or DF selected 

current EF: latest EF selected 

data field: obsolete term for Elementary File 

Dedicated File (DF): file containing access conditions and, optionally, Elementary Files (EFs) or other Dedicated Files 
(DFs) 

directory: general term for MF and DF 

Elementary File (EF): file containing access conditions and data and no other files 

file: directory or an organized set of bytes or records in the SIM 

file identifier: 2 bytes which address a file in the SIM 

GSM, DCS 1800 or PCS 1900 application: set of security mechanisms, files, data and protocols required by GSM, 
DCS 1800 or PCS 1900 

GSM session: that part of the card session dedicated to the GSM operation 

IC card SIM: obsolete term for ID-1 SIM 

ID-1 SIM: SIM having the format of an ID-1 card (see ISO 7816-1 [24]) 

Master File (MF): unique mandatory file containing access conditions and optionally DFs and/or EFs 

normal GSM operation: relating to general, CHV related, GSM security related and subscription related procedures 

padding: one or more bits appended to a message in order to cause the message to contain the required number of bits 
or bytes 

plug-in SIM: Second format of SIM (specified in clause 4) 

proactive SIM: SIM which is capable of issuing commands to the ME. Part of SIM Application Toolkit (see clause 11) 

record: string of bytes within an EF handled as a single entity (see clause 6) 

record number: number which identifies a record within an EF 

record pointer: pointer which addresses one record in an EF 

root directory: obsolete term for Master File 

SIM application toolkit procedures: defined in TS 11. 14 [27] 

3.2 Abbreviations 

For the purposes of the present document, the following abbreviations apply, in addition to those listed in 
TR 21.905 [2]: 

A3 Algorithm 3, authentication algorithm; used for authenticating the subscriber 

A3 8 A single algorithm performing the functions of A3 and A8 

A5 Algorithm 5, cipher algorithm; used for enciphering/deciphering data 

A8 Algorithm 8, cipher key generator; used to generate K^ 

ACM Accumulated Call Meter 

ADM Access condition to an EF which is under the control of the authority which creates this file 

ADN Abbreviated Dialling Number 

AHAG Ad-Hoc Authentication Group 

A-Key Authentication Key 

ALW ALWays 
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AMPS 

ANSI 

AoC 

APDU 

ATR 

BCCH 

BCD 

BDN 

BTS 

CB 

CBMI 

CCP 

CHV 

CLA 

CNL 

CPBCCH 

CTS 

DCK 

DCS 

DF 

DTMF 

ECC 

EF 

EIA 

eMLPP 

ETSI 

etu 

FDN 

GSM 

HPLMN 

IC 

ICC 

ID 

lEC 

lEI 

IMSI 

ISO 

Kc 

Ki 

LAI 

Igth 

END 

LSA 

LSAID 

LSB 

MCC 

ME 

MF 

MMI 

MNC 

MS 

MSB 

MSISDN 

NAM 

NET 

NEV 

NPI 

OEM 

OPLMN 

OTA 



Analogue Mobile Phone System 

American National Standards Institute 

Advice of Charge 

Application Protocol Data Unit 

Answer To Reset 

Broadcast Control CHannel 

Binary Coded Decimal 

Barred Dialling Number 

Base Transmitter Station 

Cell Broadcast 

Cell Broadcast Message Identifier 

Capability/Configuration Parameter 

Card Holder Verification information; access condition used by the SIM for the verification of 

the identity of the user 

CLASS 

Co-operative Network List 

COMPACT Packet BCCH 

Cordless Telephony System 

De-personalization Control Keys 

Digital Cellular System 

Dedicated File (abbreviation formerly used for Data Field) 

Dual Tone Multiple Frequency 

Emergency Call Code 

Elementary File 

Electronics Industries Alliance (North America) 

enhanced Multi-Level Precedence and Pre-emption Service 

European Telecommunications Standards Institute 

elementary time unit 

Fixed Dialling Number 

Global System for Mobile communications 

Home PLMN 

Integrated Circuit 

Integrated Circuit(s) Card 

IDentifier 

International Electrotechnical Commission 

Information Element Identifier 

International Mobile Subscriber Identity 

International Organization for Standardization 

Cryptographic key; used by the cipher A5 

Subscriber authentication key; the cryptographic key used by the authentication algorithm, A3, 

and cipher key generator, A8 

Location Area Information; information indicating a cell or a set of cells 

The (specific) length of a data unit 

Last Number Dialled 

Localised Service Area 

Localised Service Area Identity 

Least Significant Bit 

Mobile Country Code 

Mobile Equipment 

Master File 

Man Machine Interface 

Mobile Network Code 

Mobile Station 

Most Significant Bit 

Mobile Station international ISDN number 

Numeric Assignment Module 

NET work 

NEVer 

Numbering Plan Identifier 

Operational Feature Monitor 

Operator Controlled PLMN (Selector List) 

Over The Air 
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PDC Personal Digital Communications 

PIN/PIN2 Personal Identification Number / Personal Identification Number 2 (obsolete terms for CHVl 

and CHV2, respectively) 

PLMN Public Land Mobile Network 

PPS Protocol and Parameter Select (response to the ATR) 

PUK/PUK2 PIN Unblocking Key / PIN2 Unblocking Key (obsolete terms for UNBLOCK CHV 1 and 

UNBLOCK CHV2, respectively) 

RAND A RANDom challenge issued by the network 

RFU Reserved for Future Use 

SDN Service Dialling Number 

SID System IDentity 

SIM Subscriber Identity Module 

SMS Short Message Service 

SoLS A Support of Localised Service Area 

SRES Signed RESponse calculated by a SIM 

SSC Supplementary Service Control string 

S W 1/SW2 Status Word 1 / Status Word 2 

TETRA TErrestrial Trunk RAdio 

TIA Telecommunications Industries Association (North America) 

TMSI Temporary Mobile Subscriber Identity 

TON Type Of Number 

TP Transfer layer Protocol 

TPDU Transfer Protocol Data Unit 

TS Technical Specification 
UNBLOCK CHV 1/2 value to unblock CHV1/CHV2 

VBS Voice Broadcast Service 

VGCS Voice Group Call Service 

VPLMN Visited PLMN 

3.3 Symbols 

For the purposes of the present document, the following symbols apply: 

'0' to '9' and 'A' to 'F' the sixteen hexadecimal digits 

Vcc Supply voltage 

Vpp Programming voltage 



4 Physical characteristics 

Two physical types of SIM are specified. These are the "ID-1 SIM" and the "Plug-in SIM". 

The physical characteristics of both types of SIM shall be in accordance with those specified for the UICC in TS 

102 221 [55] 

5 Electronic signals and transmission protocols 

The present document contains references to the UICC/Terminal interface specification, TS 102 221 [55]. For the 
requirements of TS 102 221 [55] which are referenced by the present specification, the usage of the term "UICC" shall 
be equivalent to the term "SIM". 



5.1 Electrical specifications 



Electrical specifications of the SIM - ME interface shall be in accordance with TS 102 221 [55] with the following 
limitations.: 

4MHz shall be the maximum clock speed specified for SIMs for 3V and below. 
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Power consumption during a SIM session and initial communication establishment i.e during the ATR shall not exceed 
the values defined for the ATR in TS 102 221 [55]. 

5.2 Initial communication establishment procedures 

Initial communication establishment procedures shall be in accordance with TS 102 221 [55] with the following 
limitations. 

Since 4MHz is the maximum clock speed specified for SIMs for 3V and below, the respective limitations on power 
consumption given in TS 102 221 [55] apply. 

ATR content: The ME shall invoke the error handling as defined in TS 102 221 [55] if a SIM indicates other values 
than or 255 in TCI. T=15 global interface parameters are optional. The coding of the historical bytes may not follow 
TS 102 221 [55] and need not to be interpreted by the ME. 

PPS proceedures: Speed enhancement is optional for the SIM. However if speed enhancement is implemented at least 
F=512 and D=8 shall be supported. 

Reset procedures: The SIM shall behave as a "Type 1 UICC". 

Clock stop mode: The clock shall only be switched off subject to the conditions specified in the file characteristics (see 
clause 9.2.1). It is mandatory for a SIM operating at Class B or C operating conditions as defined in TS 102 221 [55] to 
support clock stop mode. 

5.2.1 Error handling for speed enhancement 

If the SIM does not answer the PPS request within the initial waiting time the ME shall reset the SIM. After two failed 
PPS attempts using F=512 and D=8 or values indicated in TAl, (no PPS response from the SIM) the ME shall initiate 
PPS procedure using default values. If this also fails (no PPS response from the SIM) the ME may proceed using default 
values without requesting PPS. 

If the SIM does not support the values requested by the ME, the SIM shall respond to the PPS request indicating the use 
of default values. 



5.3 Transmission protocols 



Physical and Data link layer of the Transmission Protocols shall be in accordance with TS 102 221 [55] with the 
following limitations. 

The support of the Transmission Protocol T=0 is mandatory for ME and the SIM. All other protocols are optional. Use 
of other protocols than T=0 is not defined in the present document. 

Procedure bytes '61' and '6C' shall not be used with GSM commands. Status byte '9F' is returned instead by the SIM to 
control exchanges between the Transport Layer of the terminal and the SIM. 

5.4 Clock 

If a frequency of 13/4 MHz is needed by the SIM to run the authentication procedure in the allotted time (see 
TS 03.20 [11]), or to process an ENVELOPE command used for SIM Data Download, bit 2 of byte 1 in the file 
characteristics shall be set to 1. Otherwise a minimum frequency of 13/8 MHz may be used. 



Application and File structure 



This clause describes the logical structure for a SIM if different from that specified in TS 102 221 [55],, the code 
associated with it, and the structure of files used. 
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6.1 SIM Application structure 



Figure 3 shows the general structural relationships which may exist between files. The files are organized in a 
hierarchical structure and are of one of the types as defined in TS 102 221 [55]. These files may be either administrative 
or application specific. The operating system handles the access to the data stored in different files. 
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Figure 3: Organization of memory 

Files are composed of a header, which is internally managed by the SIM, and optionally a body part. The information of 
the header is related to the structure and attributes of the file and may be obtained by using the commands GET 
RESPONSE or STATUS. This information is fixed during the administrative phase. The body part contains the data of 
the file. 



6.2 



Void 



6.3 



Void 



6.4 File types 

The SIM shall support the file types as defined in TS 102 221 [55] with the following limitations. 

6.4.1 Dedicated files 

The SIM does not support the operations that can be performed on an ADF as defined in TS 102 221 [55], although the 
SIM application DF is considered to be an ADF according to the definitions in TS 102 221 [55]. 

6.4.2 Elementary files 

The SIM supports the elementary files as defined in TS 102 221 [55] with the following limitations 



6.4.2.1 



Cyclic EF 



After selection of a cyclic file (for either operation), the record pointer shall address the record updated or increased 
last. If an action following selection of a record is aborted, then the record pointer shall remain set at the record at which 
it was set prior to the action. 
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6.5 Methods for selecting a file 



After the Answer To Reset (ATR), the Master File (MF) is impHcitly selected and becomes the Current Directory. Each 
file may then be selected by using the SELECT function as specified in TS 102 221 [53] with the following exception: 

Only support selection by file ID referencing and the command parameters as specified in the present 
document. 



Security features 



The security aspects of GSM are described in the normative references TS 02.09 [4] and TS 03.20 [11]. This clause 
gives information related to security features supported by the SIM to enable the following: 

authentication of the subscriber identity to the network; 

data confidentiality over the radio interface; 

file access conditions. 

7.1 Authentication and cipher key generation procedure 

This clause describes the authentication mechanism and cipher key generation which are invoked by the network. For 
the specification of the corresponding procedures across the SIM/ME interface see clause 1 1 . 

The network sends a Random Number (RAND) to the MS. The ME passes the RAND to the SIM in the command RUN 
GSM ALGORITHM. The SIM returns the values SRES and Kc to the ME which are derived using the algorithms and 
processes given below. The ME sends SRES to the network. The network compares this value with the value of SRES 
which it calculates for itself The comparison of these SRES values provides the authentication. The value Kc is used by 
the ME in any future enciphered communications with the network until the next invocation of this mechanism. 

A subscriber authentication key Ki is used in this procedure. This key Ki has a length of 128 bits and is stored within 
the SIM for use in the algorithms described below. 

7.2 Algorithms and processes 

The names and parameters of the algorithms supported by the SIM are defined in TS 03.20 [11]. These are: 

Algorithm A3 to authenticate the MS to the network; 

Algorithm A8 to generate the encryption key. 

These algorithms may exist either discretely or combined (into A38) within the SIM. In either case the output on the 
SIM/ME interface is 12 bytes. The inputs to both A3 and A8, or A38, are Ki (128 bits) internally derived in the SIM, 
and RAND (128 bits) across the SIM/ME interface. The output is SRES (32 bits)/Kc (64 bits) the coding of which is 
defined in the command RUN GSM ALGORITHM in clause 9. 

7.3 File access conditions 

Every file has its own specific access condition for each command. The relevant access condition of the last selected 
file shall be fulfilled before the requested action can take place. 

For each file: 

the access conditions for the commands READ and SEEK are identical; 

the access conditions for the commands SELECT and STATUS are ALWays. 
No file access conditions are currently assigned by GSM to the MF and the DFs. 
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The access condition levels are defined in the following table: 

Table 7: Access condition level coding 



Level 


Access Condition 





ALWays 


1 


CHV1 


2 


CHV2 


3 


Reserved for GSM Future Use 


4 to 14 


ADM 


15 


NEVer 



The meaning of the file access conditions is as follows: 

ALWAYS: The action can be performed without any restriction; 

CHVl (card holder verification 1): The action shall only be possible if one of the following three conditions is 
fulfilled: 

a correct CHVl value has already been presented to the SIM during the current session; 

the CHVl enabled/disabled indicator is set to "disabled"; 

NOTE: Some Phase 1 and Phase 2 SIMs do not necessarily grant access when CHVl is "disabled" and "blocked". 

UNBLOCK CHVl has been successfully performed during the current session; 

CHV2: The action shall only be possible if one of the following two conditions is fulfilled: 

a correct CHV2 value has already been presented to the SIM during the current session; 

UNBLOCK CHV2 has been successfully performed during the current session; 

ADM: Allocation of these levels and the respective requirements for their fulfilment are the responsibility of the 
appropriate administrative authority 

The definition of access condition ADM does not preclude the administrative authority from using ALW, CHVl, 
CHV2 and NEV if required. 

NEVER: The action cannot be performed over the SIM/ME interface. The SIM may perform the action 
internally. 

Condition levels are not hierarchical. For instance, correct presentation of CHV2 does not allow actions to be performed 
which require presentation of CHVL A condition level which has been satisfied remains valid until the end of the GSM 
session as long as the corresponding secret code remains unblocked, i.e. after three consecutive wrong attempts, not 
necessarily in the same card session, the access rights previously granted by this secret code are lost immediately. A 
satisfied CHV condition level applies to both DpQgjyj and DFjgL£(;;Q]y[. 

The ME shall determine whether CHV2 is available by using the response to the STATUS command. If CHV2 is "not 
initialized" then CHV2 commands, e.g. VERIFY CHV2, shall not be executable. 



8 



Void 



Description of the commands 



The command description and structure is defined in TS 102 221 [55]. The coding of the CLA, INS and parameter bytes 
are according to TS 102 221 [55] with the limitations stated in the command description in the present document.This 
clause states the general principles for mapping the commands and responses onto Application Protocol Data Units 
which are used by the transmission protocol. 
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9.1 Mapping principles 



The mapping of protocol T=0 with respect to the TPDU level is according to TS 102 221 with the following exceptions: 

The use of procedure byte '6C' for Case 2 commands as defined in TS 102 221 shall be replaced by the usage of 
'9F' as described in case 2b below. According to the present document the status byte '9F' triggers a GET 
RESPONSE command whereas the procedure byte '6C' in TS 102 221 triggers re-issuing of the same command. 

The use of procedure byte '61' for Case 4 commands as defined in TS 102 221 shall be replaced by the usage of 
'9F' as described in case 4 below. According to the present document the status byte '9F' triggers one GET 
RESPONSE command, which is optional for the ME, whereas the procedure byte '61' in TS 102 221 triggers one 
or more GET RESPONSE commands depending upon the procedure bytes following the GET RESPONSE 
command. 

For some commands described in the present document it is necessary for T=0 to use a supplementary transport service 
command (GET RESPONSE) to obtain the output data. For example, the SELECT function needs the following two 
commands: 

the first command (SELECT) has both parameters and data serving as input for the function; 

the second command (GET RESPONSE) has a parameter indicating the length of the data to be returned. 

If the length of the response data is not known beforehand, then its correct length may be obtained by applying the first 
command and interpreting the status words. SWl shall be '9F' and SW2 shall give the total length of the data. Other 
status words may be present in case of an error. The various cases are: 

Case 1: No input / No output 



PI 



P2 



P3 



\ 

Igth (='00') 



SWl 



'90' 



SW2 



'00' 



Case 2a: No input / Output of known length 

I CLA I INS I PI I P2 I P3 
1 

Igth 



DATA with length Igth 



SWl 



'90' 



SW2 



'00' 



NOTE: lgth='00' causes a data transfer of 256 bytes. 
Case 2b: No Input / Output of unknown length 

I CLA I INS I PI I P2 I P3 I 



\ 

Igth (='00') 



SWl SW2 

1 1 

'9F' Igth^ 



GET RESPONSE 

I CLA I INS I PI I P2 I P3 



lgth2 



DATA with length Igthg < Igthj^ SWl SW2 

— \ — — r~ 

'90' '00' 



Case 3: Input / No output 

I CLA I INS I PI I P2 I P3 I DATA with length Igth 
^ 

igth 



SWl SW2 

~~i — — r~ 

'90' '00' 



Case 4: Input / Output of known or unknown length 

I CLA I INS I PI I P2 I P3 I DATA with length Igth 
^ 

Igth 



SWl SW2 

1 1 

'9F' Igth^ 



£75/ 



3GPP TS 51.011 version 4.4.0 Release 4 



20 



ETSI TS 151 Oil V4.4.0 (2002-06) 



GET RESPONSE 

I CLA I INS I PI 



P2 



P3 



DATA with length Igthg ^ Igth-j^ 



SWl SW2 



Igthg 



"T" 
'90' 



-1~ 
'00' 



For case 4, in case of an ENVELOPE for SIM data download, SW1/SW2 may also indicate that there is response data 
with the value '9EXX', and the ME shall then send a GET RESPONSE command to get this response data. 

The following diagrams show how the five cases of transmission protocol identified in the above diagrams can all be 
used to send pro-active SIM commands. For further information on the diagrams below see TS 11.14 [27]. 



Case 1: No input / "OK" response with no output, plus additional command from SIM 

I CLA I INS I PI I P2 I P3 I 



\ 

Igth (='00') 



SWl SW2 

1 1 

'91' Igth^ 



[Possible "normal GSM operation" command/response pairs] 



FETCH 

I CLA I INS I PI I P2 



P3 

— r~ 

Igth-, 



DATA with length Igthj^ 



SWl SW2 

~~i — — r~ 

'90' '00' 



NOTE: lgthj='00' causes a data transfer of 256 bytes. 
Case 2a: No input / "OK" response with data of known length, plus additional command from SIM 

I DATA with length Igth I 



CLA INS PI P2 P3 

1 

Igth 



SWl SW2 

n — — r~ 

'91' Igth^ 



[Possible "normal GSM operation" command/response pairs] 



FETCH 

I CLA I INS I PI I P2 



P3 



DATA with length Igthj^ 



Igth^ 



SWl SW2 



~\ T" 

'90' '00' 



NOTE: lgth='00' causes a data transfer of 256 bytes. The same applies to Igthi. 
Case 2b: No Input / "OK" response with data of unknown length, plus additional command from SIM 



CLA INS PI P2 



P3 



\ 

Igth (='00') 



SWl SW2 

1 1 

'9F' lgth-|_ 



GET RESPONSE 

I CLA I INS I PI I P2 I P3 



Igthg 



DATA with length Igthg < Igthj^ SWl SW2 

— \ — — r~ 

'91' Igth- 



[Possible "normal GSM operation" command/response pairs] 



FETCH 

I CLA I INS I PI I P2 



P3 



DATA with length Igth, 



Igth, 



SWl SW2 



~\ T" 

'90' '00' 



Case 3: Input / "OK" response with no output data, plus additional command from SIM 

I CLA I INS I PI I P2 I P3 I DATA with length Igth I I SWl I SW2 

\ 1 

'91' Igth^ 



1 

Igth 
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[Possible "normal GSM operation" command/response pairs] 

FETCH 

I CLA I INS I PI I P2 I P3 I I DATA with length Igth^^ I SWl I SW2 
^ ^ 1 

Igth^ '90' '00' 

Case 4: Input / "OK" response with data of known or unknown length, plus additional command from SIM 

I CLA I INS I PI I P2 I P3 I DATA with length Igth I I SWl I SW2 

\ \ 1 

Igth '9F' Igth^ 

GET RESPONSE 

I CLA I INS I PI I P2 I P3 I I DATA with length lgth2<lgth]^ I SWl I SW2 



\ \ 1 

Igthg '91' Igthg 

[Possible "normal GSM operation" command/response pairs] 

FETCH 

I CLA I INS I PI I P2 I P3 I I DATA with length Igthg I SWl I SW2 
^ ^ 1 

Igthg '90' '00' 



9.2 Coding of the commands 



The commands are coded as specified in TS 102 221 [42] with the class byte set to 'AO'. In addition to the instruction 
codes specified TS 102 221 [55] the following codes are reserved: 

GSM operational phase: 

'IX' with X even, from X=6 to X=E. 
Administrative management phase: 

'2A', 'DO', 'D2', 'DE', 'C4', 'C6', 'C8', 'CA', 'CC, 'B4', 'B6', 'B8', 'BA' and 'BC. 

NOTE: This reservation may not be respected by other applications residing on a UICC or further evoluation of 
TS 102 221 [55]. 

9.2.1 SELECT 

The SELECT command is coded as specified in TS 102 221 [55] with the following limitations: 

- Class = 'AO' 

- P1,P2 = '00' 

- P3 = '02' 

The response to the SELECT command with the parameters as specified is as follows: 
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Response parameters/data in case of an MF or DF: 



Byte(s) 


Description 


Length 


1 -2 


RFU 


2 


3-4 


Total amount of memory of the selected directory which is 
not allocated to any of the DFs or EFs under the selected 
directory 


2 


5-6 


File ID 


2 


7 


Type of file (see clause 9.3) 


1 


8-12 


RFU 


5 


13 


Length of the following data (byte 14 to the end) 


1 


14-34 


GSIVI specific data 


21 



GSM specific data: 



Byte(s) 


Description 


Length 


14 


File characteristics (see detail 1) 


1 


15 


Number of DFs which are a direct child of the current 
directory 


1 


16 


Number of EFs which are a direct child of the current 
directory 


1 


17 


Number of CHVs, UNBLOCK CHVs and administrative 
codes 


1 


18 


RFU 


1 


19 


CHV1 status (see detail 2) 


1 


20 


UNBLOCK CHV1 status (see detail 2) 


1 


21 


CHV2 status (see detail 2) 


1 


22 


UNBLOCK CHV2 status (see detail 2) 


1 


23 


RFU 


1 


24-34 


Reserved for the administrative management 


< Igth < 1 1 



Bytes 1-22 are mandatory and shall be returned by the SIM. Bytes 23 and following are optional and may not be 
returned by the SIM. 

NOTE 1: Byte 35 and following are RFU. 

NOTE 2: The STATUS information of the MF, DFQ^jyj and DFj£lecom provide some identical application 

specific data, e.g. CHV status. On a multi- application card the MF should not contain any application 
specific data. Such data is obtained by terminals from the specific application directories. ME 
manufacturers should take this into account and therefore not use application specific data which may 
exist in the MF of a mono-application SIM. 

Similarly, the VERIFY CHV command should not be executed in the MF but in the relevant application 
directory (e.g. DFqsj^). 

Detail 1 : File characteristics 



b8 b7 b 



b5 b4 b3 b2 bl 



Clock stop (see below) 

For running the authentication algorithm, or the 

ENVELOPE command for SIM Data Download, a frequency 

is required of at least 13/8 MHz if b2=0 and 13/4 

MHz if b2=l 

Clock stop (see below) 

Supply voltage indication (see below) 

b8=0: CHVl enabled; b8=l : CHVl disabled 
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Bitbl 


BitbS 


Bitb4 


1 








1 


1 





1 





1 














1 











1 



The coding of the conditions for stopping the clock is as follows: 

clock stop allowed, no preferred level 
clock stop allowed, high level preferred 
clock stop allowed, low level preferred 
clock stop not allowed 
clock stop not allowed, unless at high level 
clock stop not allowed, unless at low level 

If bit bl (column 1) is coded 1, stopping the clock is allowed at high or low level. In this case columns 2 (bit b3) 
and 3 (bit b4) give information about the preferred level (high or low, respectively) at which the clock may be 
stopped. 

If bit b 1 is coded 0, the clock may be stopped only if the mandatory condition in column 2 (b3= 1 , i.e. stop at 
high level) or column 3 (b4=l, i.e. stop at low level) is fulfilled. If all 3 bits are coded 0, then the clock shall not 
be stopped. 

The coding of the conditions for the supply voltage indication is as follows: 



SIM Supply Voltage 


Bit 7 


Bite 


Bit 5 


5V only SIM 


(RFU) ' 


(RFU) ' 


(RFU) ' 


3V Technology SIM 


(RFU) ' 


O(RFU) ' 


1 


1.8V Technology SIM 


(RFU) ' 


1 


1 


Future Class 


1 


1 


1 


NOTE 1 The bits marked (RFU) are set to '0' and reserved for future use in the SIMs. The coding schemes 
relies on the fact that RFU bits are set to '0'. 



Detail 2: Status byte of a secret code 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Number of false presentations remaining 
('0' means blocked) 
RFU 

b8=0: secret code not initialised, 
b8=l : secret code initialised 



Response parameters/data in case of an EF: 



Byte(s) 


Description 


Length 


1 -2 


RFU 


2 


3-4 


File size 

(for transparent EF: the length of the body part of the EF) 
(for linear fixed or cyclic EF: record length multiplied by the 
number of records of the EF) 


2 


5-6 


File ID 


2 


7 


Type of file (see 9.3) 


1 


8 


see detail 3 


1 


9- 11 


Access conditions (see 9.3) 


3 


12 


File status (see 9.3) 


1 


13 


Length of the following data (byte 14 to the end) 


1 


14 


Structure of EF (see 9.3) 


1 


15 


Length of a record (see detail 4) 


1 


16 and 
following 


RFU 


- 



Bytes 1-14 are mandatory and shall be returned by the SIM. 

Byte 15 is mandatory in case of linear fixed or cyclic EFs and shall be returned by the SIM. 
Byte 15 is optional in case of transparent EFs and may not be returned by the SIM. 
Byte 16 and following (when defined) are optional and may not be returned by the SIM. 
Detail 3: Byte 8 
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For transparent and linear fixed EFs this byte is RFU. For a cyclic EF all bits except bit 7 are RFU; b7=l 
indicates that the INCREASE command is allowed on the selected cyclic file. 

Detail 4: Byte 15 

For cyclic and linear fixed EFs this byte denotes the length of a record. For a transparent EF, this byte shall 
be coded '00', if this byte is sent by the SIM. 

9.2.2 STATUS 

The STATUS command is coded as specified in TS 102 221 [55] with the following limitations: 

- Class = 'AO' 

- P1,P2 = '00' 

The response parameters/data are identical to the response parameters/data of the SELECT command in case of an MF 
orDF. 

9.2.3 READ BINARY 

The READ BINARY command is coded as specified in TS 102 221 [55] with the following limitations: 

- Class = 'AO' 

- B8 in PI shall be set to '0' 

The response is according to the command parameters as defined in TS 102 221 [55]. 

9.2.4 UPDATE BINARY 

The UPDATE BINARY command is coded as specified in TS 102 221 [55] with the following limitations: 

- Class = 'AO' 

- B8 in PI shall be set to '0' 

The response is according to the command parameters as defined in TS 102 221 [55]. 

9.2.5 READ RECORD 

The READ RECORD command is coded as specified in TS 102 221 [55] with the following limitations: 

Class = 'AO' 

P2 = '02', '03', '04' 

9.2.6 UPDATE RECORD 

The UPDATE RECORD command is coded as specified in TS 102 221 [55] with the following limitations: 

Class = 'AO' 

P2 = '02', '03', '04' 

The response is according to the command parameters, as defined in TS 102 221 [55] 

9.2.7 SEEK 

The instruction code 'A2' identifies the SEARCH RECORD command as defined in TS 102 221 [55]. In the present 
document the instruction code 'A2' is defined for the SEEK command for class 'AO'. 
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This function searches through the current Hnear fixed EF to find a record starting with the given pattern. This function 
shall only be performed if the READ access condition for this EF is satisfied. Two types of SEEK are defined: 

Type 1 The record pointer is set to the record containing the pattern, no output is available. 

Type 2 The record pointer is set to the record containing the pattern, the output is the record number. 

NOTE: A Phase 1 SIM only executes type 1 of the SEEK function. 

The SIM shall be able to accept any pattern length from 1 to 16 bytes inclusive. The length of the pattern shall not 
exceed the record length. 

Four modes are defined: 

from the beginning forwards; 

from the end backwards; 

from the next location forwards; 

from the previous location backwards. 

If the record pointer has not been previously set (its status is undefined) within the selected linear fixed EF, then the 
search begins: 

with the first record in the case of SEEK from the next location forwards; or 

with the last record in the case of SEEK from the previous location backwards. 

After a successful SEEK, the record pointer is set to the record in which the pattern was found. The record pointer shall 
not be changed by an unsuccessful SEEK function. 



COMMAND 


CLASS 


INS 


PI 


P2 


P3 


SEEK 


'AO' 


'A2' 


'00' 


Type/Mode 


igth 



Parameter P2 specifies type and mode: 

'xO' = from the beginning forward; 

'xl' = from the end backward; 

'x2' = from the next location forward; 

'x3' = from the previous location backward; 

with x='0' specifies type 1 and x='r specifies type 2 of the SEEK command. 
Command parameters/data: 



Byte(s) 


Description 


Length 


1 - Igth 


Pattern 


Igth 



There are no response parameters/data for a type 1 SEEK. A type 2 SEEK returns the following response 
parameters/data: 



Byte(s) 


Description 


Length 


1 


Record number 


1 



9.2.8 INCREASE 

The INCREASE command is coded as specified in TS 102 221 [55] with the following limitations: 
- Class = 'AO' 
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- P1,P2 = '00' 

- P3 = '03' 

The response is according to the command parameters, as defined in TS 102 221 [55] 

9.2.9 VERIFY CHV 

The VERIFY CHV is identical to the VERIFY PIN command as specified in TS 102 221 [55] with the following 
limitations: 

- Class = 'AO' 

- PI = '00' 

- P3 = '08' 

NOTE: The fiinctionality of the VERIFY CHV command is limited to CHV verification and can not be used to 
retrieve the retry counter value as specified in TS 102 221 [55]. 

Parameter P2 specifies the CHV: 

- '01' = CHV1; 

- '02' = CHV2. 

The response is according to the command parameters, as defined in TS 102 221 [55]. 

9.2.10 CHANGE CHV 

The CHANGE CHV is identical to the CHANGE PIN command as specified in TS 102 221 [55] with the following 
limitations: 

- Class = 'AO' 

- PI = '00' 
Parameter P2 specifies the CHV: 

- '01' = CHV1; 

- '02' = CHV2. 

The response is according to the command parameters, as defined in TS 102 221 [55]. 

9.2.11 DISABLE CHV 

The DISABLE CHV is identical to the DISABLE PIN command as specified in TS 102 221 [55] with the following 
limitations: 

- Class = 'AO' 

- PI = '00' 

- P2 = '01' 

NOTE: The functionality of the DISABLE CHV command is limited to CHV disabling and can not be used to 
indicate the use of an alternative CHV (global key reference) as specified in TS 102 221 [55]. 
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The response is according to the command parameters, as defined in TS 102 221 [55]. 

9.2.12 ENABLE CHV 

The ENABLE CHV is identical to the ENABLE PIN command as specified in TS 102 221 [55] with the following 
limitations: 

- Class = 'AO' 

- PI = '00' 

- P2 = '01' 

The response is according to the command parameters, as defined in TS 102 221 [55]. 

9.2.13 UNBLOCK CHV 

The UNBLOCK CHV is identical to the UNBLOCK PIN command as specified in TS 102 221 [55] with the following 
limitations: 

- Class = 'AO' 

- PI = '00' 
Parameter P2 specifies the CHV: 

- 00 = CHV1; 

- 02 = CHV2. 

NOTE: The coding '00' for CHVl differs from the coding of CHVl used for other commands. 
The response is according to the command parameters, as defined in TS 102 221 [55]. 

9.2.14 INVALIDATE 

The INVALIDATE command is identical to the DEACTIVATE command as specified in TS 102 221 [55] with the 
following limitations: 

- Class = 'AO' 

- P1,P2 = '00' 

The response is according to the command parameters, as defined in TS 102 221 [55]. 

9.2.15 REHABILITATE 

The REHABILITATE command is identical to the ACTIVATE command as specified in TS 102 221 [55] with the 
following limitations: 

- Class = 'AO' 

- P1,P2 = '00' 

The response is according to the command parameters, as defined in TS 102 221 [55]. 

9.2.1 6 RUN GSM ALGORITHM 

The RUN GSM ALGORITHM is identical to the AUTHENTICATE command as specified in TS 102 221 [55] with 
the following limitations: 

- Class = 'AO' 
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- P1,P2 = '00' 

- P3 = '10' 

The structure of the Command parameters/data is as follows only for the specified parameters:: 



Byte(s) 


Description 


Length 


1 -16 


RAND 


16 



The structure of the Response parameters/data is as follows only for the specified parameters: 



Byte(s) 


Description 


Length 


1 -4 


SRES 


4 


5-12 


Cipher Key Kc 


8 



The most significant bit of SRES is coded on bit 8 of byte 1 . The most significant bit of Kc is coded on bit 8 of byte 5. 

9.2.17 SLEEP 

This is an obsolete function used by Phase 1 MEs. 

In order to achieve phase compatibility, a SIM of Phase 2 or later shall always send the status information "normal 
ending of the command" after the successful interpretation of the command SLEEP received from a Phase 1 ME. An 
ME of Phase 2 or later shall not send a SLEEP command; 



COMMAND 


CLASS 


INS 


PI 


P2 


P3 


SLEEP 


'AO' 


'FA' 


'00' 


'00' 


'00' 



9.2.18 GET RESPONSE 

The GET RESPONSE command is coded as specified in TS 102 221 [55] with the following limitations: 

Class = 'AO' 

Since the MF is implicitly selected after activation of the SIM, GET RESPONSE is also allowed as the first command 
after activation. 

9.2.19 TERMINAL PROFILE 

The TERMINAL PROFILE command is coded as specified in TS 102 221 [55] with the following Umitations: 
- Class = 'AO' 

9.2.20 ENVELOPE 

The ENVELOPE command is coded as specified in TS 102 221 [55] with the following limitations: 
Class = 'AO' 

9.2.21 FETCH 

The FETCH command is coded as specified in TS 102 221 [55] with the following limitations: 
Class = 'AO' 

9.2.22 TERMINAL RESPONSE 

The TERMINAL RESPONSE command is coded as specified in TS 102 221 [55] with the following limitations: 
Class = 'AO' 
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9.3 Definitions and coding 

The coding conventions defined in TS 102 221 [55] applies with the following exceptions 
File status 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



bl=0 : invalidated; bl=l : not invalidated 

RFU 

b3=0 : not readable or updatable when invalidated 

b3=l : readable and updatable when invalidated 

RFU 



Bit b3 may be set to 1 in special circumstances when it is required that the EF can be read and updated even if the EF is 
invalidated, e.g. reading and updating the EFadn when the FDN feature is enabled, or reading and updating the EFgpf^ 
when the BDN feature is disabled. 

Structure of file 

'00' transparent; 
'Or linear fixed; 
'03' cyclic. 
Type of File 

- '00' RFU; 

- '01' MF; 

- '02' DF; 

- '04' EF. 

Coding of CHVs and UNBLOCK CHVs 

A CHV is coded on 8 bytes. Only (decimal) digits (0-9) shall be used, coded in ITU-T T.50 [20] with bit 8 set to zero. 
The minimum number of digits is 4. If the number of digits presented by the user is less than 8 then the ME shall pad 
the presented CHV with 'FF' before sending it to the SIM. 

The coding of the UNBLOCK CHVs is identical to the coding of the CHVs. However, the number of (decimal) digits is 
always 8. 

Coding of Access Conditions 

The access conditions for the commands are coded on bytes 9, 10 and 1 1 of the response data of the SELECT command 
if class byte 'AO' is usedEach condition is coded on 4 bits as shown in table 10. 

Table 10: Access conditions 



ALW 


'0'* 


CHV1 


'1'* 


CHV2 


'2'* 


RFU 


'3' 


ADM 


'4' 






ADM 


'E' 


NEW 


'F'* 



Entries marked "*" in the table above, are also available for use as administrative codes in addition to the ADM access 
levels '4' to 'E' (refer to clause 7.3) if required by the appropriate administrative authority. If any of these access 
conditions are used, the code returned in the Access Condition bytes in the response data shall be the code applicable to 
that particular level. 
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Byte 9: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














1 


1 


1 


1 


UPDATE 












READ; SEEK 


10: 


















b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














L 


JL 


JL 


-L 


RFU 
INCREASE 


1 


I: 


















b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














1 


1 


1 


1 


INVALIDATE 












REHABILITATE 



9.4 Status conditions returned by the card 

This clause specifies the coding of the status words SWl and SW2. 

9.4.1 Responses to commands which are correctly executed 



SWl 


SW2 


Description 


'90' 


'00' 


- normal ending of the command 


'91' 


'XX' 


- normal ending of the command, with extra information from the 
proactive S\W\ containing a command for the ME. Length 'XX' of the 
response data 


'9E' 


'XX' 


- length 'XX' of the response data given in case of a SIM data download 
error 


'9F' 


'XX' 


- length 'XX' of the response data 



9.4.2 Responses to commands which are postponed 



SWl 


SW2 


Error description 


'93' 


'00' 


- SIM Application Toolkit is busy. Command cannot be executed at 
present, further normal commands are allowed. 



9.4.3 IVIemory management 



SWl 


SW2 


Error description 


'92' 


'OX' 


- command successful but after using an internal update retry routine 
'X' times 


'92' 


'40' 


- memory problem 



9.4.4 Referencing management 



SWl 


SW2 


Error description 


'94' 


'00' 


- no EF selected 


'94' 


'02' 


- out of range (invalid address) 


'94' 


'04' 


- file ID not found 

- pattern not found 


'94' 


'08' 


- file is inconsistent with the command 
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9.4.5 Security management 



NOTE: 



SW1 


SW2 


Error description 


'98' 


'02' 


- no CHV initialized 


'98' 


'04' 


- access condition not fulfilled 

- unsuccessful CHV verification, at least one attempt left 

- unsuccessful UNBLOCK CHV verification, at least one attempt left 

- authentication failed (see note) 


'98' 


'08' 


- in contradiction with CHV status 


'98' 


'10' 


- in contradiction with invalidation status 


'98' 


'40' 


- unsuccessful CHV verification, no attempt left 

- unsuccessful UNBLOCK CHV verification, no attempt left 

- CHV blocked 

- UNBLOCK CHV blocked 


'98' 


'50' 


- increase cannot be performed, IVIax value reached 



A Phase 1 SIM may send this error code after the third consecutive unsuccessful CHV verification 
attempt or the tenth consecutive unsuccessful unblocking attempt. 



9.4.6 Application incdepencdent errors 



SW1 


SW2 


Error description 


'67' 


'XX' 


- incorrect parameter P3 (see note) 


'6B' 


'XX'# 


- incorrect parameter P1 or P2 (see **) 


'6D' 


'XX'# 


- unknown instruction code given in the command 


'6E' 


'XX'# 


- wrong instruction class given in the command 


'6F' 


'XX'# 


- technical problem with no diagnostic given 


NOTE 1 : * These values of 'XX' are specified by ISO/IEC; at present the default value 

'XX'='00' is the only one defined. 
NOTE 2: ** When the error in PI or P2 is caused by the addressed record being out of 

range, then the return code '94 02' shall be used. 



NOTE: 'XX' gives the correct length or states that no additional information is given ('XX' = '00'). 

9.4.7 Commands versus possible status responses 

The following table shows for each command the possible status conditions returned (marked by an asterisk *). 
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Table 1 1 : Commands and status words 





OK 


B 


Mem 


Refer. 


Security 


Application 






u 


Sta 


Status 


Status 


Independent 






s 








Errors 






y 












9 


9 


9 


9 


9 


9 


9 


9 


9 


9 


9 


9 


9 


9 


9 


9 


9 


6 


6 


6 


6 


6 







1 


E 


F 


3 


2 


2 


4 


4 


4 


4 


8 


8 


8 


8 


8 


8 


7 


B 


D 


E 


F 







X 


X 


X 








4 























1 


4 


5 


X 


X 


X 


X 


X 


Commands 





X 


X 


X 





X 








2 


4 


8 


2 


4 


8 











X 


X 


X 


X 


X 


Select 








* 






* 






* 
















* 


* 




* 


* 


Status 


* 


* 










* 






















* 


* 




* 


* 


Update Binary 


* 


* 








* 


* 


* 






* 




* 




* 






* 


* 




* 


* 


Update Record 


* 


* 








* 


* 


* 


* 




* 




* 




* 






* 


* 




* 


* 


Read Binary 


* 


* 










* 


* 






* 




* 




* 






* 


* 




* 


* 


Read Record 


* 


* 










* 


* 


* 




* 




* 




* 






* 


* 




* 


* 


Seel< 


* 






* 






* 


* 




* 


* 




* 




* 






* 


* 




* 


* 


Increase 








* 




* 


* 


* 






* 




* 




* 




* 


* 


* 




* 


* 


Verify CHV 


* 


* 








* 


* 










* 


* 


* 




* 




* 


* 




* 


* 


Change CHV 


* 


* 








* 


* 










* 


* 


* 




* 




* 


* 




* 


* 


Disable CHV 


* 


* 








* 


* 










* 


* 


* 




* 




* 


* 




* 


* 


Enable CHV 


* 


* 








* 


* 










* 


* 


* 




* 




* 


* 




* 


* 


Unblock CHV 


* 


* 








* 


* 










* 


* 


* 




* 




* 


* 




* 


* 


Invalidate 


* 


* 








* 


* 


* 










* 




* 






* 


* 




* 


* 


Rehabilitate 


* 


* 








* 


* 


* 










* 




* 






* 


* 




* 


* 


Run GSIVI Algorithm 








* 






* 








* 




* 










* 


* 




* 


* 


Sleep 


* 


































* 


* 




* 


* 


Get Response 


* 


* 










* 






















* 


* 




* 


* 


Terminal Profile 


* 


* 








* 


* 






















* 


* 




* 


* 


Envelope 


* 


* 


* 


* 


* 


* 


* 






















* 


* 




* 


* 


Fetch 


* 












* 






















* 


* 




* 


* 


Terminal Response 















































The responses '91 XX', and '93 00' and '9E XX' can only be given by a SIM supporting SIM Application Toolkit, to an 
ME also supporting SIM Application Toolkit. 

For the SEEK command the response '91 XX' can be given directly after a Type 1 SEEK command. Following the 
Type 2 SEEK command the SIM can give the response '91 XX' only after the GET RESPONSE command. 



10 Contents of the Elementary Files (EF) 

This clause specifies the EFs for the GSM session defining access conditions, data items and coding. A data item is a 
part of an EF which represents a complete logical entity, e.g. the alpha tag in a EFadn record. 

EFs or data items having an unassigned value, or, which during the GSM session, are cleared by the ME, shall have 
their bytes set to 'FF'. After the administrative phase all data items shall have a defined value or have their bytes set to 
'FF'. If a data item is 'deleted' during a GSM session by the allocation of a value specified in another GSM TS, then this 
value shall be used, and the data item is not unassigned; e.g. for a deleted LAI in EFloci the last byte takes the value 
'FE' (TS 04.08 [15] refers). 

EFs are mandatory (M) or optional (O). The file size of an optional EF may be zero. All implemented EFs with a file 
size greater than zero shall contain all mandatory data items. Optional data items may either be filled with 'F', or, if 
located at the end of an EF, need not exist. 

When the coding is according to ITU-T T.50 [20], bit 8 of every byte shall be set to 0. 
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For an overview containing all files see figure 8. 

10.1 Contents of the EFs at the MF level 

The present document specifies only two Efs at the MF level. The presence of EFdir on a SIM is optional. The present 
document does not specify the mechanism to select a SIM application using EFqir. 

1 0.1 .1 EFicciD (ICC Identification) 

This EF provides a unique identification number for the SIM. The structure of this EF is as defined in TS 102 221 [55]. 
Network operators issuing a SIM according to this document may use an identification number length of 20 bytes. SIM 
issued with identification number coded on 20 bytes may also have the digits in a byte not swapped. 

10.1.2 EFpL (Preferred language) 

The structure of this data field is as defined in TS 102 221 [55]. The presence of this file is optional for a SIM. 

. This information may be used by the ME for MMI purposes. This information may also be used for the screening of 
Cell Broadcast messages in a preferred language, as follows. 

When the CB Message Identifier capability is both allocated and activated, the ME selects only those CB messages the 
language of which corresponds to an entry in this EF or in EFlp, whichever of these EFs is used (see clause 1 1 .2. 1). The 
CB message language is defined by the Data Coding Scheme (DCS: see TS 23.038 [12]) received with the CB message. 
The ME shall be responsible for translating the language coding indicated in the Data Coding Scheme for the Cell 
Broadcast Service (as defined in TS 23.038 [12]) to the language coding as defined in ISO 639 [30] if it is necessary to 
check the language coding in EFpL. 

NOTE: This file is called EFelp (Extended Langueage preference) in previous releases of the present document 

1 0.2 DFs at the GSM application level 

For compatibility with other systems based on the GSM switching platform and for special GSM services, DFs may be 
present as child directories of DFgsm- The following have been defined: 



DFiRiDIUM 


'5F30' 


DFqlOBALSTAR 


'5F31' 


DFico 


'5F32' 


DFaccS 


'5F33' 


DFmexE 


'5F3C 


DFEIAn-IA-553 


'5F40' 


DFcTs 


'5F60' 


DFsoLSA 


'5F70' 



Only the contents of DFsolsa and DFmexe are specified in the present document. For details of the EFs contained in the 
DFcTs, seeTS 11.19 [34]. 

1 0.3 Contents of files at the GSM application level 

The EFs in the Dedicated File DFqsm contain network related information. 

1 0.3.1 EFlp (Language preference) 

This EF contains the codes for one or more languages. This information, determined by the user/operator, defines the 
preferred languages of the user in order of priority. This information may be used by the ME for MMI purposes. 

This information may also be used for the screening of Cell Broadcast messages in a preferred language, as follows. 
When the CB Message Identifier capability is both allocated and activated, the ME selects only those CB messages the 
language of which corresponds to an entry in this EF or in EFelp, whichever of these EFs is used (see clause 1 1 .2. 1). 



£75/ 



3GPP TS 51.011 version 4.4.0 Release 4 



34 



ETSI TS 151 Oil V4.4.0 (2002-06) 



The CB message language is defined by the Data Coding Scheme (DCS: see TS 23.038 [12]) received with the CB 
message. The ME shall be responsible for translating the language coding indicated in the Data Coding Scheme for the 
Cell Broadcast Service (as defined in TS 23.038 [12]) to the language coding as defined in ISO 639 [30] if it is 
necessary to check the language coding in EFpL. 



Identifier: '6F05' Structure: transparent Mandatory 


File size: 1 -n bytes Update activity: low 


Access Conditions: 

READ ALW 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


1^' language code (highest prior.) 


M 


1 byte 


2 


2™ language code 





1 byte 










n 


nth language code (lowest prior.) 





1 byte 



Coding: according to language codings contained in the Data Coding Scheme (see TS 23.038 [12]). 
Using the command GET RESPONSE, the ME can determine the size of the EF. 

10.3.2 EFiMs, (IMSI) 

This EF contains the International Mobile Subscriber Identity (IMSI). 



Identifier: '6F07' 


Structure 


transparent 


Mandatory 


File size: 9 bytes 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
ADM 
ADM 
CHV1 






Bytes 


Description 


M/0 


Length 


1 


length of IMSI 


M 


1 byte 


2-9 


IMSI 


M 


8 bytes 



length of IMSI 

Contents: 

The length indicator refers to the number of significant bytes, not including this length byte, required for 
the IMSI. 

Coding: according to TS 04.08 [15]. 

IMSI 

Contents: 

International Mobile Subscriber Identity. 

Coding: 

This information element is of variable length. If a network operator chooses an IMSI of less than 15 
digits, unused nibbles shall be set to 'F'. 
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Byte 2: 



b8 b7 b6 b5 b4 b3 b2 bl 



1 

'o 
'o 

Parity 

LSB of Digit 1 



MSB of Digit 1 



For the parity bit, see TS 04.08 [15]. 
Byte 3: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 2 



MSB of Digit 2 
LSB of Digit 3 



MSB of Digit 3 



etc. 



1 0.3.3 EFko (Ciphering l<ey Kc) 

This EF contains the ciphering key Kc and the ciphering key sequence number n. 



Identifier: '6F20' 


Structure 


transparent 


Mandatory 


File size: 9 bytes 




Update activity: high 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
CHV1 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -8 


Ciphering key Kc 


M 


8 bytes 


9 


Ciphering key se 


'quence number n 




M 


1 byte 



Ciphering key Kc 

Coding: 

The least significant bit of Kc is the least significant bit of the eighth byte. The most significant bit of Kc 
is the most significant bit of the first byte. 

Ciphering key sequence number n 

Coding: 



bits b4 to b8 are coded 



NOTE: TS 04.08 [15] defines the value of n=l 1 1 as "key not available". Therefore the value '07' and not 'FF' 
should be present following the administrative phase. 



bS 


b7 


b6 


b5 


b4 


b3 


b2 


bl 
















1 1 1 
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10.3.4 EF 



PLMNsel 



(PLMN selector) 



This EF contains the coding for n PLMNs, where n is at least eight. This information determined by the user/operator 
defines the preferred PLMNs of the user in priority order. 



Identifier: '6F30' Structure: transparent 


Optional 


File size: 3n (n > 8) bytes Update activity 


: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 -3 


1''PLMN (highest priority) 


M 


3 bytes 










22-24 


8'" PLMN 


M 


3 bytes 


25-27 


9'" PLMN 





3 bytes 










(3n-2)-3n 


nth PLMN (lowest priority) 





3 bytes 



- PLMN 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

according to TS 04.08 [15]. 

If storage for fewer than the maximum possible number n is required, the excess bytes shall be set to 'FF'. 

For instance, using 246 for the MCC and 8 1 for the MNC and if this is the first and only PLMN, the 
contents reads as follows: 

Bytes 1-3: '42' 'F6' '18' 

Bytes 4-6: 'FF' 'FF' 'FF' 

etc. 

1 0.3.5 EFhplmn (HPLMN search period) 

This EF contains the interval of time between searches for the HPLMN (see TS 22.011 [5]). 



Identifier: '6F31' 


Structure 


transparent Mandatory 


File size: 1 


byte 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
ADM 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 


Time interval 


M 


1 byte 



Time interval 
Contents: 

The time interval between two searches. 
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Coding: 



The time interval is coded in integer multiples of n minutes. The range is from n minutes to a maximum 
value. The value '00' indicates that no attempts shall be made to search for the HPLMN. The encoding is: 

- '00': No HPLMN search attempts 

'01': n minutes 

'02': 2n minutes 



'YZ': (16Y+Z)n minutes (maximum value) 
All other values shall be interpreted by the ME as a default period. 
For specification of the integer timer interval n, the maximum value and the default period refer to TS 22.01 1 [5]. 



10.3.6 EF 



ACMmax 



(ACM maximum value) 



This EF contains the maximum value of the accumulated call meter. This EF shall always be allocated if EFacm is 
allocated. 



Identifier: '6F37' 


Structure: transparent Optional 


File size: 3 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 

INVALIDATE 
REHABILITATE 


CHV1 

CHV1/CHV2 

(fixed during administrative management) 

ADM 

ADM 


Bytes 


Description 


M/0 


Length 


1 -3 


Maximum value 


M 


3 bytes 



Maximum value 
Contents: 

maximum value of the Accumulated Call Meter (ACM) 
Coding: 

First byte: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



,23 -,22 ,21 ,20 ,1 



2Z0 2^^ 2^-^ 2^" 2^' 2-^° 2-^' 2 



18 ,17 ,lf 



Second byte: 



bS 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



15 ,14 ,13 ,12 ,11 ,10 



2±J 2^^ 2^" 2 



2^^ 2-" 



2' 2^ 



Third byte: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



2^ 2^ 2^ 2'' 2^ 2^ 2^ 2 



For instance, '00' '00' '30' represents 2^+2^. 
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All ACM data is stored in the SIM and transmitted over the SIM/ME interface as binary. 
ACMmax is not valid, as defined in TS 22.024 [7], if it is coded '000000'. 



1 0.3.7 EFssT (SIM service table) 



This EF indicates which services are allocated, and whether, if allocated, the service is activated. If a service is not 
allocated or not activated in the SIM, the ME shall not select this service. 



Identifier: '6F38' Structure: transparent Mandatory 


File size: X bytes, X > 2 Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Services n°1 to n°4 


M 


1 byte 


2 


Services n°5 to n°8 


M 


1 byte 


3 


Services n°9 to n°12 





1 byte 


4 


Services n°13to n°16 





1 byte 


5 


Services n°17to n°20 





1 byte 


6 


Services n°21 to n°24 





1 byte 


7 


Services n°25to n°28 





1 byte 


8 


Services n°29to n°32 





1 byte 


etc. 








X 


Services (4X-3) to (4X) 





1 byte 



-Services 
Contents: 



Service n°1 
Service n°2 
Service n°3 
Service n°4 
Service n°5 
Service n"6 
Service n°7 
Service n°8 
Service n°9 
Service n°10: 
Service n°11 
Service n°12: 
Service n°13: 
Service n°14: 
Service n°15: 
Service n°16: 
Service n°17: 
Service n°18: 
Service n°19: 
Service n°20: 
Service n°21 
Service n°22: 
Service n°23: 
Service n°24: 
Service n°25: 
Service n°26: 
Service n°27: 
Service n°28: 
Service n°29: 
Service n°30: 
Service n°31 
Service n°32: 
Service n°33: 
Service n°34: 
Service n°35: 
Service n°36: 
Service n°37: 
Service n°38: 
Service n°39: 



CHV1 disable function 

Abbreviated Dialling Numbers (ADN) 

Fixed Dialling Numbers (FDN) 

Short Message Storage (SMS) 

Advice of Charge (AoC) 

Capability Configuration Parameters (CCP) 

PLMN selector 

RFU 

MSISDN 

Extensioni 

Extension2 

SMS Parameters 

Last Number Dialled (LND) 

Cell Broadcast Message Identifier 

Group Identifier Level 1 

Group Identifier Level 2 

Service Provider Name 

Service Dialling Numbers (SON) 

Extensions 

RFU 

VGCS Group Identifier List (EFvggs and EFvggss) 

VBS Group Identifier List (EFvbs and EFvbss) 

enhanced Multi-Level Precedence and Pre-emption Service 

Automatic Answer for eMLPP 

Data download via SMS-CB 

Data download via SMS-PP 

Menu selection 

Call control 

Proactive SIM 

Cell Broadcast Message Identifier Ranges 

Barred Dialling Numbers (BDN) 

Extension4 

De-personalization Control Keys 

Co-operative Network List 

Short Message Status Reports 

Network's indication of alerting in the MS 

Mobile Originated Short Message control by SIM 

GPRS 

Image (IMG) 
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Service n°40: 
Service n°41 
Service n°42: 
Service n°43: 
Service n 44: 
Service n 45: 
Service n 46: 
Service n 47: 
Service n°48: 
Service n°49: 
Service n°50: 
Service n°51 
Service n°52: 
Service n°53: 
Service n°54: 
Service n°55: 
Service n°56: 



SoLSA (Support of Local Service Area) 

USSD string data object supported in Call Control 

RUN AT COMMAND command 

User controlled PLMN Selector with Access Technology 

Operator controlled PLMN Selector with Access Technology 

HPLMN Selector with Access Technology 

CPBCCH Information 

Investigation Scan 

Extended Capability Configuration Parameters 

MExE 

RPLMN last used Access Technology 

PLMN Network Name 

Operator PLMN List 

Mailbox Dialling Numbers 

Message Waiting Indication Status 

Call Forwarding Indication Status 

Service Provider Display Information 



For a phase 2 SIM, the EF shall contain at least two bytes which correspond to the Phase 1 services. Further bytes may 
be included, but if the EF includes an optional byte, then it is mandatory for the EF to also contain all bytes before that 
byte. Other services are possible in the future and will be coded on further bytes in the EF. The coding falls under the 
responsibility of ETSI. 

NOTE 1 : Service N°8 was used in Phase 1 for Called Party Subaddress. To prevent any risk of incompatibility 
Service N°8 should not be reallocated. 

NOTE 2: As the BDN service relies on the Call Control feature, service n°3 1 (BDN) should only be allocated and 
activated if service n°28 (Call control) is allocated and activated. 

Coding: 

2 bits are used to code each service: 
first bit = 1 : service allocated 
first bit = 0: service not allocated 

where the first bit is bl, b3, b5 or b7; 
second bit = 1 : service activated 
second bit = 0: service not activated 

where the second bit is b2, b4, b6 or bS. 

Service allocated means that the SIM has the capability to support the service. Service activated means that 
the service is available for the card holder (only valid if the service is allocated). 

The following codings are possible: 

first bit = 0: service not allocated, second bit has no meaning; 

first bit = 1 and second bit = 0: service allocated but not activated; 

first bit = 1 and second bit = 1 : service allocated and activated. 

The bits for services not yet defined shall be set to RFU. For coding of RFU see clause 9.3. 
First byte: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Service n°l 

Service n°2 

Service n°3 

Service n°4 
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Second byte: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Service n°5 

Service n°6 

Service n°7 

Service n°8 



etc. 

The following example of coding for the first byte means that service n°l "CHVl -Disabling" is allocated but 
not activated: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 

X 


1 

X 


1 

X 


1 

X 


1 

X 


1 

X 


1 




1 

1 



If the SIM supports the FDN feature (FDN allocated and activated) a special mechanism shall exist in the SIM which 
invalidates both EFimsi and EFloci once during each GSM session. This mechanism shall be invoked by the SIM 
automatically if FDN is enabled. This invalidation shall occur at least before the next command following selection of 
either EF. FDN is enabled when the ADN is invalidated or not activated. 

If the SIM supports the BDN feature (BDN allocated and activated) a special mechanism shall exist in the SIM which 
invalidates both EFimsi and EFloci once during each GSM session and which forbids the REHABILITATE command to 
rehabilitate both EFimsi and EFloci until the PROFILE DOWNLOAD procedure is performed indicating that the ME 
supports the "Call control by SIM" facility. This mechanism shall be invoked by the SIM automatically if BDN is 
enabled. The invalidation of EFimsi and EFlqci shall occur at least before the next command following selection of 
either EF. BDN is enabled when the EFbdn is not invalidated. 

1 0.3.8 EFacm (Accumulated call meter) 

This EF contains the total number of units for both the current call and the preceding calls. 

NOTE: The information may be used to provide an indication to the user for advice or as a basis for the 
calculation of the monetary cost of calls (see TS 22.086 [9]). 



Identifier: '6F39' Structure: cyclic Optional 


Record length: 3 bytes Update activity: high 


Access Conditions: 

READ CHVl 
UPDATE CHV1/CHV2 

(fixed during administrative management) 
INCREASE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/O 


Length 


1 -3 


Accumulated count of units 


M 


3 bytes 



Accumulated count of units 
Contents: value of the ACM 
Coding: see the coding of EFACMmax 



1 0.3.9 EFg,di (Group Identifier Level 1 ) 

This EF contains identifiers for particular SIM-ME associations. It can be used to identify a group of SIMs for a 
particular application. 
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Identifier: '6F3E' 




Structure 


transparent 


Optional 


File size: 1-n 


bytes 






Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 






CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -n 


SIM group identifier(s) 





n bytes 



1 0.3.1 EFg,d2 (Group Identifier Level 2) 

This EF contains identifiers for particular SIM-ME associations. It can be used to identify a group of SIMs for a 
particular application. 



Identifier: '6F3F' 




Structure 


transparent 


Optional 


File size: 1-n 


bytes 






Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 






CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -n 


SIM group identifier(s) 





n bytes 



NOTE: The structure of EFgidi and EFgid2 are identical. They are provided to allow the network operator to 
enforce different levels of security dependant on application. 

10.3.1 1 EFsPN (Service Provider Name) 

This EF contains the service provider name and appropriate requirements for the display by the ME. 



Identifier: '6F46' 




Structure 


transparent 




Optional 


File Size: 17 


bytes 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




ALWAYS 
ADM 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 


Display Condition 


M 


1 byte 


2-17 


Service Provider f 


slame 




M 


16 bytes 



Display Condition 

Contents: display condition for the service provider name in respect to the registered PLMN (see 
TS 02.0722.101 [53]). 

Coding: see below 

Byte 1: 
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b8 b7 b 



b5 b4 b3 b2 bl 



bl=0 : display of registered PLMN not required when 
registered PLMN is either HPLMN or a PLMN in 
the Service Provider PLMNN List (see EFspdi) . 

bl=l : display of registered PLMN required when 

registered PLMN is either HPLMN or a PLMN in 
the Service Provider PLMN List (see EFspdi) ■ 

b2=0 : display of the service provider name is 

required when registered PLMN is neither HPLMN 
nor a PLMN in the service provider PLMN 
list (see EFspdi) ■ 

b2=l : display of the service provider name is not 

required when registered PLMN is neither HPLMN 
nor a PLMN in the service provider PLMN 
list (see EFspdi) • 
"rfu (see clause 9.3) 



Service Provider Name 

Contents: service provider string 

Coding: the string shall use either 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [12] with bit 8 set to 0. The string shall be 
left justified. Unused bytes shall be set to 'FF'; or 

one of the UCS2 code options defined in annex B. 

10.3.12 EFpucT (Price per unit and currency table) 

This EF contains the Price per Unit and Currency Table (PUCT). The PUCT is Advice of Charge related information 
which may be used by the ME in conjunction with EF^^-jy; to compute the cost of calls in the currency chosen by the 

subscriber, as specified in TS 22.024 [7]. This EF shall always be allocated if EFacm is allocated. 



Identifier: '6F41' 


Structure: transparent Optional 


File size: 5 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 

INVALIDATE 
REHABILITATE 


CHV1 

CHV1/CHV2 

(fixed during administrative management) 

ADM 

ADM 


Bytes 


Description 


M/0 


Length! 


1 -3 


Currency code 


M 


3 bytes 


4-5 


Price per unit 


M 


2 bytes 



Currency code 

Contents: 

the alpha-identifier of the currency code. 

Coding: 

bytes 1, 2 and 3 are the respective first, second and third character of the alpha identifier. This 
alpha-tagging shall use the SMS default 7-bit coded alphabet as defined in TS 23.038 [12] with bit 8 set 
toO. 

Price per unit 

Contents: 

price per unit expressed in the currency coded by bytes 1-3. 

Coding: 
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Byte 4 and bits bl to b4 of byte 5 represent the Elementary Price per Unit (EPPU) in the currency coded 
by bytes 1-3. Bits b5 to b8 of byte 5 are the decimal logarithm of the multiplicative factor represented by 
the absolute value of its decimal logarithm (EX) and the sign of EX, which is coded for a positive sign 
and 1 for a negative sign. 



Byte 4: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



Byte 5: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 




















1 
23 


1 
22 


1 

2l 


1 

2° 


of EPPU 

Sign of EX 
2° of Abs (EX) 
2^ of Abs (EX) 
2^ of Abs (EX) 



















































The computation of the price per unit value is made by the ME in compliance with TS 22.024 [7] by the 
following formula: 

price per unit = EPPU * 10^^. 
The price has to be understood as expressed in the coded currency. 

1 0.3.1 3 EFcBMi (Cell broadcast message identifier selection) 

This EF contains the Message Identifier Parameters which specify the type of content of the cell broadcast messages 
that the subscriber wishes the MS to accept. 

Any number of CB Message Identifier Parameters may be stored in the SIM. No order of priority is applicable. 



Identifier: '6F45' Structure: transparent Optional 


File size: 2n bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 -2 


CB Message Identifier 1 





2 bytes 


3-4 


CB Message Identifier 2 





2 bytes 










2n-1 - 2n 


CB Message Identifier n 





2 bytes 



Cell Broadcast Message Identifier 
Coding: 

as in TS 23.041, "Message Format on BTS-MS Interface - Message Identifier". 

Values listed show the types of message which shall be accepted by the MS. 

Unused entries shall be set to 'FF FF'. 
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1 0.3.1 4 EFbcch (Broadcast control channels) 

This EF contains information concerning the BCCH according to TS 04.08 [15]. 

BCCH storage may reduce the extent of a Mobile Station's search of BCCH carriers when selecting a cell. The BCCH 
carrier lists in an MS shall be in accordance with the procedures specified in TS 04.08 [15]. The MS shall only store 
BCCH information from the System Information 2 message and not the 2bis extension message. 



Identifier: '6F74' 


Structure 


transparent Mandatory 


File size: 16 bytes 




Update activity: high 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
CHV1 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 -16 


BCCH information 


M 


16 bytes 



BCCH information 

Coding: 

The information is coded as octets 2-17 of the "neighbour cells description information element" in 
TS 04.08 [15]. 

1 0.3.1 5 EFacc (Access control class) 

This EF contains the assigned access control class(es). TS 22.01 1 [5] refers. The access control class is a parameter to 
control the RACH utilization. 15 classes are split into 10 classes randomly allocated to normal subscribers and 5 classes 
allocated to specific high priority users. For more information see TS 22.01 1 [5]. 



Identifier: '6F78' 


Structure 


transparent 


Mandatory 


File size: 2 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -2 


Access control classes 


M 


2 bytes 



Access control classes 

Coding: 

Each ACC is coded on one bit. An ACC is "allocated" if the corresponding bit is set to 1 and "not 
allocated" if this bit is set to 0. Bit b3 of byte 1 is set to 0. 

Byte 1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



15 14 13 12 11 10 09 08 Number of the ACC (except for bit b3) 



Byte 2: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



37 06 05 04 03 02 01 



Number of the ACC 
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1 0.3.1 6 EFppLMN (Forbidden PLMNs) 



This EF contains the coding for four Forbidden PLMNs (FPLMN). It is read by the ME as part of the SIM initialization 
procedure and indicates PLMNs which the MS shall not automatically attempt to access. 

A PLMN is written to the EF if a network rejects a Location Update with the cause "PLMN not allowed". The ME shall 
manage the list as follows. 

When four FPLMNs are held in the EF, and rejection of a further PLMN is received by the ME from the network, the 
ME shall modify the EF using the UPDATE command. This new PLMN shall be stored in the fourth position, and the 
existing list "shifted" causing the previous contents of the first position to be lost. 

When less than four FPLMNs exist in the EF, storage of an additional FPLMN shall not cause any existing FPLMN to 
be lost. 

Dependent upon procedures used to manage storage and deletion of FPLMNs in the EF, it is possible, when less than 
four FPLMNs exist in the EF, for 'FFFFFF' to occur in any position. The ME shall analyse all the EF for FPLMNs in 
any position, and not regard 'FFFFFF' as a termination of valid data. 



Identifier: '6F7B' 


Structure: transparent 


Mandatory 


File size: 12 bytes 


Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
CHV1 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 -3 


PLMN 1 


M 


3 bytes 


4-6 


PLMN 2 


M 


3 bytes 


7-9 


PLMNS 


M 


3 bytes 


10- 12 


PLMN 4 


M 


3 bytes 



- PLMN 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 

Coding: 

according to TS 04.08 [15]. 

For instance, using 246 for the MCC and 8 1 for the MNC and if this is stored in PLMN 3 the contents is 
as follows: 

Bytes 7-9: '42"F6" 18' 

If storage for fewer than 4 PLMNs is required, the unused bytes shall be set to 'FF'. 

1 0.3.1 7 EFloci (Location information) 

This EF contains the following Location Information: 
Temporary Mobile Subscriber Identity (TMSI); 
Location Area Information (LAI); 

- TMSI TIME; 

Location update status. 

In the case when updating EFloci with data containing the TMSI value and the card reports the error '92 40' (Memory 
Problem), the ME shall terminate GSM operation. 
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Identifier: '6F7E' Structure: transparent IVIandatory 


File size: 1 1 bytes Update activity: high 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE CHV1 


Bytes 


Description 


M/0 


Length 


1 -4 


TMSI 


M 


4 bytes 


5-9 


LAI 


M 


5 bytes 


10 


TMSI TIME 


M 


1 byte 


11 


Location update status 


M 


1 byte 



TMSI 

Contents: Temporary Mobile Subscriber Identity 
Coding: according to TS 04.08 [15]. 
Byte 1: first byte of TMSI 





b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 




1 1 1 1 1 

MSB 


1 


1 


1 


LAI 








Contents: Location Area Information 








Coding: according to TS 04.08 [15]. 








Byte 


5: first byte of LAI 










b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 




1 


1 


1 


1 


1 


1 


1 


1 



MSB 



TMSI TIME 

Contents: Current value of Periodic Location Updating Timer (T3212). 

This byte is used by Phase 1 MEs, but it shall not be used by Phase 2 MEs. 

Location update status 

Contents: status of location update according to TS 04.08 [15]. 

Coding: 

Byte 11: 

Bits: 




1 



b3 


b2 


bl 








updated 





1 


not updated 


1 





PLMN not allowed 


1 


1 


Location Area not allowed 


1 


1 


reserved 



Bits b4 to b8 are RFU (see clause 9.3). 
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1 0.3.1 8 EFad (Administrative data) 



This EF contains information concerning the mode of operation according to the type of SIM, such as normal (to be 
used by PLMN subscribers for GSM operations), type approval (to allow specific use of the ME during type approval 
procedures of e.g. the radio equipment), cell testing (to allow testing of a cell before commercial use of this cell), 
manufacturer specific (to allow the ME manufacturer to perform specific proprietary auto-test in its ME during 
e.g. maintenance phases). 

It also provides an indication of whether some ME features should be activated during normal operation as well as 
information about the length of the MNC, which is part of the International Mobile Subscriber Identity (IMSI). 



Identifier: '6FAD' Structure: transparent Mandatory 


File size: 3+X bytes Update activity: low 


Access Conditions: 

READ ALW 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


MS operation mode 


M 


1 byte 


2 to 3 


Additional information 


M 


2 bytes 


4 


length of MNC in the IMSI 





1 byte 


5 to 4+X 


RFU 





X bytes 



MS operation mode 

Contents: mode of operation for the MS 

Coding: 

Initial value 

normal operation 
- type approval operations 

normal operation + specific facilities 
type approval operations + specific facilities 
maintenance (off line) 
cell test operation 
Additional information 
Coding: 

specific facilities (if bl=l in byte 1); 
Byte 2 (first byte of additional information): 



'00' 
'80' 
'01' 

'81' 
'02' 
'04' 



b8 



hi 



b6 



b5 



b4 



b3 



b2 



bl 



RFU 



Byte 3: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

























































bl=0: OFM to be disabled by the ME 
bl=l: OFM to be activated by the ME 
RFU 



The OFM bit is used to control the Ciphering Indicator as specified in TS 02.07 [3] 
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- ME manufacturer specific information (if b2=l in byte 1). 

Length of MNC in the IMSI : 
Contents: 

The length indicator refers to the number of digits, used for extracting the MNC from the IMSI 
Coding: 

Byte 4: 



This value codes the number of digits of the MNC in 
the IMSI. Only the values '0010' and '0011' are 
currently specified, all other values are reserved 
for future use. 
RFU (see clause 9.3) . 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 













































1 0.3.1 9 EFphase (Phase identification) 

This EF contains information concerning the phase of the SIM. 



Identifier: '6FAE' 


Structure 


transparent Mandatory 


File size: 1 


byte 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




ALW 
ADM 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 


SIM Phase 


M 


1 byte 



- SIM Phase 

Coding: 

'00': phase 1 

'02': phase 2 

'03': phase 2 and PROFILE DOWNLOAD required (see TS U.U [27]). 

All other codings are reserved for specification by ETSI TC SMG. Codings '04' to 'OF' indicate that the SIM 
supports, as a minimum, the mandatory requirements defined in this specification. 

This phase identification does not preclude a SIM to support some features of a phase later than the one indicated in 
EFphase- For example : if EFphase is coded '00', it may be assumed by the ME that some Phase 2 or Phase 2+ features are 
supported by this SIM; if EFphase is coded '02' or '03', it may be assumed by the ME that some Phase 2+ features are 
supported by this SIM. 

However, the services n°3 (FDN) and/or n°5 (AoC) shall only be allocated and activated in SIMs of phase 2 or later 
with EFphase being coded '02' or greater. Similarly, service n°31 (BDN) shall only be allocated and activated in SIMs 
with EFphase being coded '03' or greater. 

If EFphase is coded '03' or greater, an ME supporting SIM Application Toolkit shall perform the PROFILE 
DOWNLOAD procedure, as defined in TS n.l4 [27]. 



1 0.3.20 EFvGcs (Voice Group Call Service) 



This EF contains a list of those "VGCS group identifiers the user has subscribed to. The elementary file is used by the 
ME for group call establishment and group call reception. 
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Identifier: '6FB1' 


Structure: transparent 


Optional 


File size: 4n bytes (n <= 


50) Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
ADM 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 -4 


Group ID 1 


M 


4 bytes 


5-8 


Group ID 2 





4 bytes 










(4n-3)-4n 


Group ID n 





4 bytes 



Group ID 

Contents: VGCS Group ID, according to TS 23.003 [10] 

Coding: 

The VGCS Group ID is of a variable length with a maximum length of 8 digits. Each VGCS Group ID is 
coded on four bytes, with each digit within the code being coded on four bits corresponding to BCD code. 
If a VGCS Group ID of less than 8 digits is chosen, then the unused nibbles shall be set to 'F'. VGCS 
Group ID Digit 1 is the most significant digit of the Group ID. 



Byte 1: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 1 of Group ID 1 



MSB of Digit 1 of Group ID 1 
LSB of Digit 2 of Group ID 1 



MSB of Digit 2 of Group ID 1 



Byte 2: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 3 of Group ID 1 



MSB of Digit 3 of Group ID 1 
LSB of Digit 4 of Group ID 1 



MSB of Digit 4 of Group ID 1 



Byte 3: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 5 of Group ID 1 



MSB of Digit 5 of Group ID 1 
LSB of Digit 6 of Group ID 1 



MSB of Digit 6 of Group ID 1 
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Byte 4: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 7 of Group ID 1 



MSB of Digit 7 of Group ID 1 
LSB of Digit 8 of Group ID 1 



MSB of Digit 8 of Group ID 1 



: etc 

Byte (4n-3)-4n: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 7 of Group ID n 



MSB of Digit 7 of Group ID n 
LSB of Digit 8 of Group ID n 



MSB of Digit 8 of Group ID n 



If Storage for fewer than the maximum possible number n of VGCS Group IDs, is required, the excess 
bytes shall be set to 'FF'. 

1 0.3.21 EFvGcss (Voice Group Call Service Status) 

This EF contains the status of activation for the VGCS group identifiers. The elementary file is directly related to the 
EFvGcs- This EF shall always be allocated if EFvgcs is allocated. 



Identifier: '6FB2' 


Structure 


transparent 


Optional 


File size: 7 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -7 


Activation/Deactivation Flags 


M 


7 bytes 



Activation/Deactivation Flags 

Contents: Activation/Deactivation Flags of the appropriate Group IDs 

Coding: 

bit = means - Group ID deactivated 

bit = 1 means - Group ID activated 
Byte 1: 
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b8 



b7 



b5 



b5 



b4 



b3 



b2 



bl 



etc 



Byte 7: 



b8 b7 b 



b5 b4 b3 b2 bl 



Group ID 1 



Group ID 8 



Group ID 4 9 
Group ID 50 

'b3 = l 

'b4 = l 

'b5=l 

'b6=l 

'b7 = l 

'b8=l 



1 0.3.22 EFvBs (Voice Broadcast Service) 

This EF contains a list of those VBS group identifiers the user has subscribed to. The elementary file is used by the ME 
for broadcast call establishment and broadcast call reception. 



Identifier: '6FB3' 


Structure: transparent 


Optional 


File size: 4n bytes (n <= 


50) Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
ADM 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 -4 


Group ID 1 


M 


4 bytes 


5-2 


Group ID 2 





4 bytes 










(4n-3)-4n 


Group ID n 





4 bytes 



Group ID 

Contents: VBS Group ID, according to TS 23.003 [10] 

Coding: 

The VBS Group ID is of a variable length with a maximum length of 8 digits. Each VBS Group ID is 
coded on four bytes, with each digit within the code being coded on four bits corresponding to BCD code. 
If a VBS Group ID of less than 8 digits is chosen, then the unused nibbles shall be set to 'F'. VBS Group 
ID Digit 1 is the most significant digit of the Group ID. 
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Bytel: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 1 of Group ID 1 



MSB of Digit 1 of Group ID 1 
LSB of Digit 2 of Group ID 1 



MSB of Digit 2 of Group ID 1 



Byte 2: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 3 of Group ID 1 



MSB of Digit 3 of Group ID 1 
LSB of Digit 4 of Group ID 1 



MSB of Digit 4 of Group ID 1 



Byte 3: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 5 of Group ID 1 



MSB of Digit 5 of Group ID 1 
LSB of Digit 6 of Group ID 1 



MSB of Digit 6 of Group ID 1 



Byte 4: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 7 of Group ID 1 



MSB of Digit 7 of Group ID 1 
LSB of Digit 8 of Group ID 1 



MSB of Digit 8 of Group ID 1 



: etc 

Byte (4n-3)-4n: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 7 of Group ID n 



MSB of Digit 7 of Group ID n 
LSB of Digit 8 of Group ID n 



MSB of Digit 8 of Group ID n 



If Storage for fewer than the maximum possible number n of VBS Group IDs, is required, the excess 
bytes shall be set to 'FF'. 
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1 0.3.23 EFvBss (Voice Broadcast Service Status) 

This EF contains the status of activation for the VBS group identifiers. The elementary file is directly related to the 
EFvBs- This EF shall always be allocated if EFvbs is allocated. 



Identifier: '6FB4' 


Structure 


transparent 


Optional 


File size: 7 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -7 


Activation/Deactivation Flags 


M 


7 bytes 



Activation/Deactivation Flags 

Contents: Activation/Deactivation Flags of the appropriate Group IDs 

Coding: 

see coding of EFyocs 

10.3.24 EFeMLPP (enlnanced Multi Level Pre-emption and Priority) 

This EF contains information about priority levels and fast call set-up conditions for the enhanced Multi Level Pre- 
emption and Priority service that which can be used by the subscriber. 



Identifier: '6FB5' Structure: transparent Optional 


File size: 2 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Priority levels 


M 


1 byte 


2 


Fast call set-up conditions 


M 


1 byte 



Priority levels 

Contents: The eMLPP priority levels subscribed to. 

Coding: Each eMLPP priority level is coded on one bit. Priority levels subscribed to have their corresponding 
bits set to 1 . Priority levels not subscribed to have their corresponding bits set to 0. Bit b8 is reserved and set 
toO. 

Byte 1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 




level 
level 
level 
level 
level 
level 
level 




















L 


priority 
priority 


A 
B 






priority 











priority 


1 








priority 


2 








priority 


3 








priority 


4 
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NOTE: Priority levels A and B can not be subscribed to (see TS 22.067 [42] for details). 
EXAMPLE 1: If priority levels 0, 1 and 2 are subscribed to, EFgjyj^pp shall be coded 'IC. 

Fast call set-up conditions 

Contents: For each eMLPP priority level, the capability to use a fast call set-up procedure. 

Coding: Each eMLPP priority level is coded on one bit. Priority levels for which fast call set-up is allowed have 
their corresponding bits set to 1 . Priority levels for which fast call set-up is not allowed have their corresponding 
bits set to 0. Bit b8 is reserved and set to 0. 



Byte 2: fast call set-up condition for: 



b8 b7 b 



b5 b4 b3 b2 bl 



fast call set-up condition for priority level A 

fast call set-up condition for priority level B 

fast call set-up condition for priority level 

fast call set-up condition for priority level 1 

fast call set-up condition for priority level 2 

fast call set-up condition for priority level 3 

fast call set-up condition for priority level 4 

'o 



EXAMPLE 2: If fast call set-up is allowed for priority levels and 1, then byte 2 of EF^jyi^pp is coded 'OC. 

1 0.3.25 EpAAeM (Automatic Answer for eMLPP Service) 

This EF contains those priority levels (of the Multi Level Pre-emption and Priority service) for which the mobile station 
shall answer automatically to incoming calls. 



Identifier: '6FB6' 




Structure 


transparent 


Optional 


File size: 1 


byte 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
CHV1 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Automatic answer 


priority levels 




M 


1 byte 



Automatic answer priority levels 
Contents: 



For each eMLPP priority level, the capability for the mobile station to answer automatically to incoming 
calls (with the corresponding eMLPP priority level). 



Coding: 



Each eMLPP priority level is coded on one bit. Priority levels allowing an automatic answer from the 
mobile station have their corresponding bits set to 1 . Priority levels not allowing an automatic answer 
from the mobile station have their corresponding bits set to 0. Bit b8 is reserved and set to 0. 
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Bytel: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 




answer 
answer 
answer 
answer 
answer 
answer 
answer 


priority 
priority 
priority 
priority 
priority 
priority 
priority 


for 
for 
for 
for 
for 
for 
for 




















1 


Automatic 


priority level A 




Automatic 


priority level B 






Automatic 


priority level 






Automatic 


priority level 1 






Automatic 


priority level 2 






Automatic 


priority level 3 






Automatic 


priority level 4 














EXAMPLE: If automatic answer is allowed for incoming calls with priority levels A, and 1, then EF^^gjyj^pp 
is coded 'OD'. 

1 0.3.26 EFcBMiD (Cell Broadcast Message Identifier for Data Download) 

This EF contains the message identifier parameters which specify the type of content of the cell broadcast messages 
which are to be passed to the SIM. 

Any number of CB message identifier parameters may be stored in the SIM. No order of priority is applicable. 



Identifier: '6F48' Structure: transparent Optional 


File size: 2n bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1-2 


CB Message Identifier 1 





2 bytes 


3-4 


CB Message Identifier 2 





2 bytes 










2n-1-2n 


CB Message Identifier n 





2 bytes 



Cell Broadcast Message Identifier 

Coding: 

as in TS 23.041 [14]. Values listed show the identifiers of messages which shall be accepted by the MS 
to be passed to the SIM. 

Unused entries shall be set to 'FF FF'. 



1 0.3.27 EFecc (Emergency Call Codes) 

This EF contains up to 5 emergency call codes. 
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Identifier: '6FB7' Structure: transparent 


Optional 


File size: 3n (n < 5) bytes Update activity 


: low 


Access Conditions: 

READ ALW 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 -3 


Emergency Call Code 1 





3 bytes 


4-6 


Emergency Call Code 2 





3 bytes 










(3n-2) - 3n 


Emergency Call Code n 





3 bytes 



Emergency Call Code 
Contents: 



Emergency Call Code 



Coding: 



The emergency call code is of a variable length with a maximum length of 6 digits. Each emergency call 
code is coded on three bytes, with each digit within the code being coded on four bits as shown below. If 
a code of less that 6 digits is chosen, then the unused nibbles shall be set to 'F'. 



Byte 1: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 1 



MSB of Digit 1 
LSB of Digit 2 



MSB of Digit 2 



Byte 2: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 3 



MSB of Digit 3 
LSB of Digit 4 



MSB of Digit 4 



Byte 3: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 5 



MSB of Digit 5 
LSB of Digit 6 



MSB of Digit 6 
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1 0.3.28 EFcBMiR (Cell broadcast message identifier range selection) 

This EF contains ranges of cell broadcast message identifiers that the subscriber wishes the MS to accept. 

Any number of CB Message Identifier Parameter ranges may be stored in the SIM. No order of priority is applicable. 



Identifier: '6F50' Structure: transparent Optional 


File size: 4n bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 -4 


CB Message Identifier Range 1 





4 bytes 


5-8 


CB Message Identifier Range 2 





4 bytes 










(4n-3) - 4n 


CB Message Identifier Range n 





4 bytes 



Cell Broadcast Message Identifier Ranges 



Contents: 



CB Message Identifier ranges: 



Coding: 

bytes one and two of each range identifier equal the lower value of a cell broadcast range, bytes three and 
four equal the upper value of a cell broadcast range, both values are coded as in TS 23.041 [14] 
"Message Format on BTS-MS Interface - Message Identifier". Values listed show the ranges of messages 
which shall be accepted by the MS. 

Unused entries shall be set to 'FF FF FF FF'. 

1 0.3.29 EFdck De-personalization Control Keys 

This EF provides storage for the de-personalization control keys associated with the OTA de-personalization cycle of 
TS 22.022. 



Identifier: '6F2C' Structure: transparent Optional 


File size: 1 6 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 4 


8 digits of network de-personalization control key 


M 


4 bytes 


5 to 8 


8 digits of network subset de-personalization 
control key 


M 


4 bytes 


9 to 12 


8 digits of service provider de-personalization 
control key 


M 


4 bytes 


13to16 


8 digits of corporate de-personalization control 
key 


M 


4 bytes 



Empty control key records shall be coded 'FFFFFFFF'. 
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1 0.3.30 EFcNL (Co-operative Network List) 

This EF contains the Co-operative Network List for the multiple network personalization services defined in 
TS 22.022. 



Identifier: '6F32' 


Structure 


transparent 




Optional 


File size: 6n 


bytes 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
ADM 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 to 6 


Element 1 of co- 


operative net list 







6 bytes 




6n-5 to 6n 


Element 


n of co- 


operative net list 







6 bytes 



Co-operative Network List 
Contents: 

PLMN network subset, service provider ID and corporate ID of co-operative networks. 
Coding: 

For each 6 byte list element 
Byte 1 to 3 : PLMN (MCC + MNC) : according to TS 04.08 [15]. 
Byte 4: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LS bit of network subset digit 1 



MS bit of network subset digit 1 
LS bit of network subset digit 2 



MS bit of network subset digit 2 



Byte 5: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LS bit of service provider digit 1 



MS bit of service provider digit 1 
LS bit of service provider digit 2 



MS bit of service provider digit 2 



Byte 6: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LS bit of corporate digit 1 



MS bit of corporate digit 1 
LS bit of corporate digit 2 



MS bit of corporate digit 2 
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Empty fields shall be coded with 'FF'. 

The end of the list is delimited by the first MCC field coded 'FFF'. 

1 0.3.31 EFnia (Network's Indication of Alerting) 

This EF contains categories and associated text related to the Network's indication of alerting in the MS service defined 
in TS 02.07 [3]. 



Identifier: '6F51' 




Structure: 


linear fixed 


Optional 


Record length : 


X+1 bytes 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Alerting category 


M 


1 byte 


2 to X+1 


Informative text 


M 


X bytes 



Alerting category 
Contents: 

category of alerting for terminating traffic. 
Coding: 

according to TS 04.08 [15]. Value 'FF' means that no information on alerting category is available. 
Informative text 
Contents: 

text describing the type of terminating traffic associated with the category. 

Coding: 

see the coding of the Alpha Identifier item of the EFadn (clause 10.5.1). The maximum number of 
characters for this informative text is indicated in TS 02.07 [3]. 

1 0.3.32 EFkogprs (GPRS Ciphering key KcGPRS) 

This EF contains the ciphering key KcGPRS and the ciphering key sequence number n for GPRS (see TS 23.060 [32]). 



Identifier: '6F52' Structure: transparent Optional 


File size: 9 bytes Update activity: high 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 -8 


Ciphering key KcGPRS 


M 


8 bytes 


9 


Ciphering key sequence number n for GPRS 


M 


1 byte 



Ciphering key KcGPRS 
Coding: 
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The least significant bit of KcGPRS is the least significant bit of the eighth byte. The most significant bit 
of KcGPRS is the most significant bit of the first byte. 

Ciphering key sequence number n for GPRS 

Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 
















1 1 1 

























bits b4 to b8 are coded 

NOTE: TS 04.08 [15] defines the value of n=l 11 as "key not available". Therefore the value '07' and not 'FF' 
should be present following the administrative phase. 

1 0.3.33 EFlocigprs (GPRS location information) 

This EF contains the following Location Information: 

Packet Temporary Mobile Subscriber Identity (P-TMSI); 

Packet Temporary Mobile Subscriber Identity signature value (P-TMSI signature value); 

Routing Area Information (RAI); 

Routing Area update status. 



Identifier: '6F53' Structure: transparent 


Optional 


File size: 14 bytes Update activity: high 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 -4 


P-TMSI 


M 


4 bytes 


5-7 


P-TMSI signature value 


M 


3 bytes 


8-13 


RAI 


M 


6 bytes 


14 


Routing Area update status 


M 


1 byte 



P-TMSI 

Contents: Packet Temporary Mobile Subscriber Identity 
Coding: according to TS 04.08 [15]. 
Byte 1: first byte of P-TMSI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



P-TMSI signature value 

Contents: Packet Temporary Mobile Subscriber Identity signature value 

Coding: according to TS 04.08 [15]. 

Byte 5: first byte of P-TMSI signature value 



bS 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 
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b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



Routing area update status 

Contents: status of routing area update according to TS 04.08 [15]. 

Coding: 



Byte 14: 

Bits: 



b3 


b2 


bl 













: updated 








1 


: not updated 





1 





: PLMN not allowed 





1 


1 


: Routing Area not allowed 


1 


1 


1 


: reserved 



Bits b4 to b8 are RFU (see clause 9.3). 

10.3.34 EFsuME (SetUpMenu Elements) 

This EF contains Simple TLVs related to the menu title to be used by a SIM card supporting the SIM API when issuing 
a SET UP MENU proactive command. 



Identifier: '6F54' 




Structure 


transparent 


Optional 


File size: X+Y 


bytes 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




ADM 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -X 


Title Alpha Identifier 


M 


X bytes 


1 +x - X+Y 


Title Icon Identifier 





Y bytes 



Title Alpha Identifier 
Contents: 

this field contains the Alpha Identifier Simple TLV defining the menu title text. 
Coding: 

according to TS 11.14 [27]. 
Title Icon Identifier 
Contents: 

this field contains the Icon Identifier Simple TLV defining the menu title icon. 

Coding: 

according to GSM 11.14 [27]. 

If not present the field shall be set to 'FF'. 
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Unused bytes of this file shall be set to 'FF'. 



10.3.35 EF 



PLMNwAcT 



(User controlled PLMN Selector with Access Technology) 



This EF contains coding for n PLMNs, where n is at least eight. This information, determined by the user, defines the 
preferred PLMNs of the user in priority order. The EF also contains the Access Technologies for each PLMN in this 

list, (see TS 23.122 [51]). 



ldentifier:'6F60' Structure: transparent Optional 


File size: 5n (n > 8) bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 3 


I'^'PLMN (highest priority) 


M 


3 bytes 


4 to 5 


1**' PLMN Access Technology Identifier 


M 


2 bytes 


6 to 8 


2"" PLMN 


M 


3 bytes 


9 to 10 


2"" PLMN Access Technology Identifier 


M 


2 bytes 










36 to 38 


8" PLMN 


M 


3 bytes 


39 to 40 


8" PLMN Access Technology Identifier 


M 


2 bytes 


41 to 43 


9'" PLMN 





3 bytes 


44 to 45 


9'" PLMN Access Technology Identifier 





2 bytes 










(5n-4) to (5n-2) 


N'" PLMN (lowest priority) 





3 bytes 


(5n-1)to5n 


N'" PLMN Access Technology Identifier 





2 bytes 



PLMN 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

according to TS 24.008 [47]. 

Access Technologies 

Contents: The Access Technologies of a PLMN that the MS will assume when searching for a listed PLMN. 

Coding: 

2 bytes are used to select the access technology where the meaning of each bit is as follows: 

- bit = 1 : access technology selected; 

- bit = 0: access technology not selected. 



Byte5n-1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 
































L 


RFU 

RFU 










RFU 












RFU 














RFU 
















RFU 


















RFU 




















Re 



Reserved (see 3G TS 31.102 [52]) 
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Byte 5n: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 
































L 


RFU 
RFU 










RFU 












RFU 














RFU 
















RFU 


















GSM COMPACT 




















GSM 



The RPU bits are coded with '0' in the bit positions. 

1 0.3.36 EFoPLMNwAcT (Operator controlled PLMN Selector with Access 
Technology) 

This EF contains coding for n PLMNs, where n is at least eight. This information, determined by the operator, defines 
the preferred PLMNs of the operator in priority order. The EF also contains the Access Technologies for each PLMN in 

this list (see TS 23.122 [51]). 



Identifier: '6F61' Structure: transparent Optional 


File size: 5n (n > 8) bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 3 


I'^'PLMN (highest priority) 


M 


3 bytes 


4 to 5 


1^' PLMN Access Technology Identifier 


M 


2 bytes 










36 to 38 


8'" PLMN 


M 


3 bytes 


39 to 40 


8" PLMN Access Technology Identifier 


M 


2 bytes 


41 to 43 


9'" PLMN 





3 bytes 


44 to 45 


9'" PLMN Access Technology Identifier 





2 bytes 










(5n-4) to (5n-2) 


N'" PLMN (lowest priority) 





3 bytes 


(5n-1)to5n 


N" PLMN Access Technology Identifier 





2 bytes 



PLMN 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

according to TS 24.008 [47]. 
Access Technologies 

Contents: The Access Technologies of a PLMN that the MS will assume when searching for a listed PLMN. 
Coding: See EFplmnwAct for coding. 
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10.3.37 EF 



HPLMNwAcT 



(HPLMN Selector with Access Technology) 



The HPLMN Selector with access technology data field shall contain the HPLMN code, or codes together with the 
respective access technology in priority order (see TS 23.122 [51]). 



Identifier: '6F62' Structure: transparent 


Optional 


File size: 5n bytes Update activity 


: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 3 


1''PLMN (highest priority) 


M 


3 bytes 


4 to 5 


1^' PLMN Access Technology Identifier 


M 


2 bytes 


6 to 8 


2™ PLMN 





3 bytes 


9 to 10 


2™ PLMN Access Technology Identifier 





2 bytes 










(5n-4) to (5n-2) 


N'" PLMN (lowest priority) 





3 bytes 


(5n-1)to5n 


N'" PLMN Access Technology Identifier 





2 bytes 



PLMN 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

according to TS 24.008 [47]. 

Access Technology 

Contents: The Access Technology of the HPLMN that the MS will assume when searching for the HPLMN, in 
priority order. The first Access Technology in the list has the highest priority. 



Coding: See EFp 



for coding. 



10.3.38 EFcPBccH (CPBCCH Information) 

This EF contains information concerning the CPBCCH according to TS 04.18 [48] and TS 03.22 [45]. 

CPBCCH storage may reduce the extent of a Mobile Station's search of CPBCCH carriers when selecting a cell. The 
CPBCCH carrier lists shall be in accordance with the procedures specified in TS 04.18 [48], TS 04.60 [49] and 
TS 03.22 [45]. The MS stores CPBCCH information from the System Information 19 message. Packet System 
Information 3, and Packet System Information 3 bis on the SIM. The same CPBCCH carrier shall never occur twice in 
the list. 



Identifier: '6F63' Structure: transparent 


Optional 


File size: 2n bytes Update activity: high 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 2 


Element 1 of CPBCCH carrier list 


M 


2 bytes 










2n-1 to 2n 


Element n of CPBCCH carrier list 


M 


2 bytes 



Element in CPBCCH carrier list 
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Coding: 

Byte 1 : first byte of CPBCCH carrier list element 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of ARFCN 



Byte 2: second byte of CPBCCH carrier list element 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



MSB of ARFCN 
High/Low band indicator 
bits b4 to b7 are RFU 
Empty indicator 



ARFCN (10 bits) as defined in TS 05.05 [46]. 

High/Low band indicator: If the ARFCN indicates possibly a channel in the DCS 1800 or a channel in the 
PCS 1900 band, if the bit is set to '1' the channel is in the higher band (GSM 1900). If the bit is set to '0', 
the lower band (GSM 1800) is indicated. If ARFCN indicates a unique channel, this indicator shall be set 
to '0'. 

Empty indicator: If this bit is set to '1', no CPBCCH carrier is stored in this position. If the Empty 
Indicator is set to '1', the content of the CPBCCH carrier field shall be ignored. The empty indicator shall 
also be used, and set to '1', if storage of fewer than maximum number n, of CPBCCH carrier fields is 
required. 



10.3.39 EFinvscan (I nvestigatJon Scan) 



This EF contains two flags used to control the investigation scan for higher prioritized PLMNs not offering voice 
services. 



Identifier: '6F64' 


Structure 


transparent 


Optional 


File size: 1 


byte 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Investigation sea 


in flags 




M 


1 bytes 



Investigation scan flags 
Coding: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



In limited service mode 
After successful PLMN selection 
'Bits b3 to b8 are coded RFU 



A '1' in a bit position indicates that the investigation scan shall be performed for the condition corresponding to that bit 
position and a '0' that it shall not be performed. 
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If this elementary file is not present, no investigation scan shall be performed. 

1 0.3.40 EFrplmnact (RPLMN Last used Access Technology) 

This EF contains the last used access technology for the Registered PLMN, RPLMN. (see TS 23.122 [50]). This EF 
shall contain only one access technology. 

NOTE: One access technology means that only one bit is set in the entire field. 

If this EF does not exist on the SIM, then the MS shall assume that RPLMN access technology is GSM. 



Identifier: '6F65' 


Structure 


transparent 


Optional 


File size: 2+X 


bytes 




Update activity: High 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
CHV1 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 to 2 


Access Technology of RPLMN 


M 


2 bytes 


3 to 2+X 


RFU 





X bytes 



Access Technology 

Coding: 

- See EFpLMNwAcT for coding. 



1 0.3.41 EFpNN (PLMN Network Name) 



This EF contains the full and short form versions of the network name for the registered PLMN. The ME shall use these 
versions in place of its own versions of the network name for the PLMN (stored in the ME's memory list), and also in 
place of the versions of the network name received when registered to the PLMN, as defined by 3G TS 24.008 [47]. 

The first record in this EF is used for the default network name when registered to the HPLMN. Subsequent records are 
to be used for other network names. 



Identifier: '6FC5' 




Structure: 


linear 


fixed 


Optional 


Record length: X 


bytes 






Update activity: low 


Access Conditions: 
READ 
UPDATE 
ACTIVATE 
DEACTIVATE 




ALWAYS 
ADM 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 toX 


Network 


name TLV objects 






M 


X bytes 



Network Name TLV objects. 

The content and coding (Full name for network and Short name for network) is defined below, where the fields 

within the objects are defined in 3G TS 24.008 [47]: 
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Coding of the Network Name TLV objects 



Length 


Description 


Status 


1 byte 


Full name for network lEI 
(This shall be the same as that used in the 
IVIM information message). 


M 


1 byte 


Length of Full name for network Name 
contents 


M 


Y bytes 


Full name for network contents (Octets 3 to n 
of network name information element) 


M 


1 byte 


Short name for network lEI 

(This shall be the same as that used in the MM 

information message). 





1 byte 


Length of Short name for network 


C1 


Z bytes 


Short name for network contents (Octets 3 to n 
of network name information element) 


C1 


C1 : this field shall be present if the short name for network lEI is present 



Unused bytes shall be set to 'FF'. 

1 0.3.42 EFoPL (Operator PLMN List) 

This EF contains a prioritised list of Location Area Information (LAI) identities that are used to associate a specific 
operator name contained in EFp^N with the LAI. The ME shall use this EF in association with the EFpnn in place of any 
network name stored within the ME's internal list and any network name received when registered to the PLMN, as 
defined by 3G TS 24.008 [47]. 

If the EFpNN is not present then this file shall not be present. 



Identifier: '6FC6' Structure: linear fixed Optional 


Record length: X bytes, X >= 8 Update activity: low 


Access Conditions: 

READ ALWAYS 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 7 


Location Area Identity 


M 


7 bytes 


8 


PLMN Network Name Record Identifier 


M 


1 byte 



Location Area Identity 

Contents: 

Location Area Information, this comprises of the MCC, MNC and two LACs 

Coding: 

PLMN: according to TS 24.008 [47] 

A BCD value of 'D' in any of the MCC and/or MNC digits shall be used to indicate a "wild" value for that 
corresponding MCC/MNC digit 

LAC : according to 3G TS 24.008 [47] 

Two values for the LAC are stored in order to allow a range of LAC values to be specified for a given 
PLMN. A value of '0000' stored in bytes 4 to 5 and a value of 'FFFE' stored in bytes 6 to 7 shall be used to 
indicate the entire range of LACs for the given PLMN. In the case where only a single LAC value is to be 
specified then the value stored in bytes 4 to 5 shall be identical to the value stored in bytes 6 to 7 for the 
given PLMN. If a range of LAC values are to be specified, then the value stored in bytes 4 to 5 shall be the 
start of the LAC range and the value stored in bytes 6 to 7 shall be the end of the LAC range for the given 
PLMN. 
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- PLMN Network Name Record Identifier 

Contents: 

Identifier of operator name to be displayed 

Coding: 

A value of '00' indicates that the name is to be taken from other sources, see 3G TS 22.101 [53] 

A value in the range '01' to 'FE' indicates the record number in EFpnn that shall be displayed as the registered 
PLMN name 

NOTE: The intent of this file is to provide exceptions to the other sources of a network name. Care should be 
taken not to introduce too many PLMN entries. An excessive number of entries could result in a longer 
initialisation period. 

10.3.43 EFmbdn (Mailbox Dialling Numbers) 

This EF contains dialling numbers to access mailboxes associated with Voicemail, Fax, Electronic Mail and other 
messages. It may also contain associated alpha-tags for each supported mailbox. Each dialling number shall be 
associated with a message waiting indication group type using EFmbi (see 3G TS 23.038 [12] for message waiting 
indication group types). 

This EF is mandatory if EFsst indicates that the Mailbox Dialling Numbers service is available. 



Identifier: '6FC7' Structure: linear fixed Optional 


Record length: X+14 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN/ADM 

(fixed during administrative management) 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Dialling Number/SSC contents 


M 


1 bytes 


X+1 3 


Extended Capability Configuration Parameters 


M 


1 byte 


X+14 


Extension 6 Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of the EFadn (clause 10.5.1), with the exception 
that extension records are stored in the EFext6 and with the exception that Capability/Configuration parameters are 
stored in the EFeccp 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 

EFadn- 



10.3.44 EFmbi (Mailbox Identifier) 



This EF contains information to associate mailbox dialling numbers in EFmbdn with a message waiting indication group 
type and subscriber profile (as defined in 3G TS 23.097 [54]). A message waiting indication group type may either be 
Voicemail, Fax, Electronic Mail or Other (as defined in 3G TS 23.038 [12] for Data Coding Scheme). 

This EF contains as many records as there are subscriber profiles (shall be record to subscriber profile). Each record 
contains references to mailbox dialling numbers in EFmbdn (one reference for each message waiting indication group 
type). 

This EF is mandatory if EFsst indicates that the Mailbox Dialling Numbers service is available. 
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Identifier: '6FC9' Structure: linear fixed Optional 


Record length: X bytes, X>=4 Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN/ADM 

(fixed during administrative management) 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Mailbox Dialling Number Identifier- Voicemail 


M 


1 byte 


2 


Mailbox Dialling Number Identifier - Fax 


M 


1 byte 


3 


Mailbox Dialling Number Identifier - Electronic 
Mail 


M 


1 byte 


4 


Mailbox Dialling Number Identifier - Other 


M 


Ibyte 



Mailbox Dialling Number Identifier (message waiting group type = Voicemail, Fax, Electronic Mail or Other). 
Contents: 

Identifies the mailbox dialling number to be associated with message waiting type. 

Coding: 

'00' - no mailbox dialling number associated with message waiting indication group type 
'xx' - record number in EFmbdn associated with message waiting indication group type 



1 0.3.45 EFmwis (Message Waiting Indication Status) 

This EF contains the status of indicators that define whether or not a Voicemail, Fax, Electronic Mail or Other message 
is waiting (as defined in 3G TS 23.038 [12] for message waiting indication group types). The ME uses the status after 
re-activation to determine whether or not to display the respective message-waiting indication on its display. 

This EF contains as many records as there are subscriber profiles (shall be record to subscriber profile) as defined in 3G 
TS 23.097 [54] for MSP. 



Identifier: '6FCA' Structure: Linear fixed Optional 


Record length: X bytes, X >= 5 Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Message Waiting Indicator Status 


M 


1 byte 


2 


Number of Voicemail Messages Waiting 


M 


1 byte 


3 


Number of Fax Messages Waiting 


M 


1 byte 


4 


Number of Electronic Mail Messages Waiting 


M 


1 byte 


5 


Number of Other Messages Waiting 


M 


1 byte 



Message Waiting Indication Status 
Contents: 

Indicates the status of the message-waiting indication. 

Coding: 

The indicator status for each indicator type is 1 bit long and set as follows: 
bit = 1 : Set Indication Active 
bit = 0: Set Indication Inactive 
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b8 b7 b 



b5 b4 b3 b2 bl 



Message Waiting Indication Status - Voicemail 

Message Waiting Indication Status - Fax 

Message Waiting Indication Status - Electronic Mail 

Message Waiting Indication Status - Other 

RFU 



Number of Voicemail Messages Waiting 
Contents: 

Contains the number of voicemail messages waiting (see 3G TS 23.040 [13]). 
Coding: 

Binary. 

Number of Fax Messages Waiting 
Contents: 

Contains the number of fax messages waiting (see 3G TS 23.040 [13]). 
Coding: 

Binary. 

Number of Electronic Mail Messages Waiting 
Contents: 

Contains the number of electronic mail messages waiting (see 3G TS 23.040 [13]) 
Coding: 

Binary. 

Number of Other Messages Waiting 
Contents: 

Contains the number of other messages waiting (see 3G TS 23.040 [13]). 
Coding: 

Binary. 

10.3.46 EFcFis (Call Forwarding Indication Status) 

This EF contains the status of indicators that are used to record whether call forward is active. The ME uses the status 
after re-activation to determine whether or not to display the respective Call Forwarding indicator on its display. 

This EF contains as many records as there are subscriber profiles (shall be record to subscriber profile) as defined in 3G 
TS 23.097 [54] for MSP. 



Identifier: '6FCB' Structure: Linear Fixed 


Optional 


Record length: 16 bytes Update activity: 


low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


MSP number 


M 


1 byte 


2 


CPU indicator status 


M 


1 byte 


3 


Length of BCD number 


M 


1 byte 


4 


TON and NPI 


M 


1 byte 


5 to 14 


Dialling Number 


M 


1 bytes 


15 


Extended Capability Configuration Parameters 


M 


1 byte 


16 


Extension 7 Record Identifier 


M 


1 byte 



NOTE: For contents and coding of data items not detailed below, see the respective data items of EFadn (subclause 
10.5.1), with the exception that Capability/Configuration parameters are stored in the EFeccp and Extension 7 
Record Identifier is used. 

MSP number: 
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Contents: 

The MSP number contains the Profile Identity of the subscriber profile. The Profile Identity shall be between 
land 4 as defined in 3G TS 23.097 [54] for MSP. 

Coding: 
Binary. 

CFU indicator status: 

Contents: 

Indicates the status of the call forward unconditional indicator. Service code = 21 (CFU) or 002 (for CFU 
part of all CF), as defined in 3G TS 22.030 [8] 

Coding: 



The indicator status for each indicator type is 1 bit long and is set as follows: 
bit = 1 : Set indication active 
bit = 0: Set indication inactive 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



CFU indicator status - Voice 

MMI Service code = 11 (Telephony) , as defined in 3G TS 

22.030 [8] ) . 

CFU indicator status - Fax 

MMI Service code = 13 (Fax), as defined in 3G TS 

22.030 [8] ) . 

CFU indicator status - Data 

MMI Service code = 12 (Data) , as defined in 3G TS 

22.030 [8] ) . 

RFU (e.g. for other MMI service codes) 



10.3.47 EFexts (Extensions) 



This EF is not used 



10.3.48 EFext6 (Extension6) 

This EF contains extension data of an MBDN (see MBDN in 10.3.43). 



Identifier: '6FC8' Structure: linear fixed Optional 


Record length: 1 3 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN/ADM 

(fixed during administrative management) 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


11 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding, see clause 10.5.10 (EFexti)- 
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1 0.3.49 EFext7 (Extension?) 



This EF contains extension data of a CFIS (Call Forwarding Indication Status - see 10.3.46). 



Identifier: '6FCC' 


Structure: 


linear fixed 


Optional 


Record length: 13 bytes 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 

ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


1 1 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see clause 10.5.10 (EFexti)- 

10.3.50 EFspDi (Service Provider Display Information) 

This EF contains information regarding the service provider display i.e. the service provider PLMN list. 



Identifier: '6FCD' 


Structure 


transparent 


Optional 


File size: x bytes 






Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


CHV1 
ADM 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 tox 


TLV object(s) co 
Information 


ntaining Service Provider 




M 


X bytes 



Tag Value 


Tag Description 


'A3' 


Service Provider Display Information Tag 


'80' 


Service Provider PLMN List Tag 



The Service Provider Display Information object is a constructed TLV. 

- Service Provider PLMN List 
Contents: 

This TLV contains a list of n PLMNs in which the Service Provider Name shall be displayed, as defined in 
subclause 10.3.11 (EFspn). 

Coding: 
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Description 


M/0 


Length 


Service Provider PLMN List tag 


M 


1 byte 


Length (see note) 


M 


X bytes 


1" PLMN entry 


M 


3 bytes 


2™ PLMN entry 





3 bytes 


3™ PLMN entry 





3 bytes 








n'" PLMN entry 





3 bytes 


Note: the length is 3*n bytes, where n denotes the number of PLMN entries. The length can 
be coded on one or more bytes. 



Each PLMN is coded as follows: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC) according to TS 24.008 [47]. 
In case a PLMN entry is not used, it shall be set to 'FF FF FF'. 

1 0.4 Contents of DFs at the GSM application level 
10.4.1 Contents of files at the GSIVI SoLSA level 

This clause specifies the EFs in the dedicated file DFsolsa- It only applies if the SoLSA feature is supported (see 
TS 23.073 [33]). 

The EFs contain information about the users subscribed local service areas. 

1 0.4.1 .1 EFsAi (SoLSA Access Indicator) 

This EF contains the 'LSA only access indicator'. This EF shall always be allocated if DFsolsa is present. 

If the indicator is set, the network will prevent terminated and/or originated calls when the MS is camped in cells that 
are not included in the list of allowed LSAs in EFsll- Emergency calls are, however, always allowed. 

The EF also contains a text string which may be displayed when the MS is out of the served area(s). 



Identifier: '4F30' 




Structure 


transparent 


Optional 


File size: X + 1 


bytes 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


LSA only 


access 


ndicator 




M 


1 byte 


2 to X+1 


LSA only 


access 


ndication text 




M 


X bytes 



LSA only access indicator 

Contents: indicates whether the MS is restricted to use LSA cells only or not. 

Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

























































bl=0 : LSA only access not activated 
bl=l : LSA only access activated 
RFU 



LSA only access indication text 

Contents: text to be displayed by the ME when it's out of LSA area. 



£75/ 



3GPP TS 51.011 version 4.4.0 Release 4 



74 



ETSI TS 151 Oil V4.4.0 (2002-06) 



Coding: the string shall use either 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [12] with bit 8 set to 0. The alpha identifier 
shall be left justified. Unused bytes shall be set to 'FF'; or 

one of the UCS2 coded options as defined in annex B. 

1 0.4.1 .2 EFsLL (SoLSA LSA List) 

This EF contains information describing the LSAs that the user is subscribed to. This EF shall always be allocated if 
DFsoLSA is present. 

Each LSA is described by one record that is linked to a LSA Descriptor file. Each record contains information of the 
PLMN, priority of the LSA, information about the subscription and may also contain a text string and/or an icon that 
identifies the LSA to the user. The text string can be edited by the user. 



Identifier: '4F31 ' Structure: linear fixed 


Optional 


Record length: X + 1 bytes Update activity 


: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


LSA name 





X bytes 


X+1 


Configuration parameters 


M 


1 byte 


X+2 


RFU 


M 


1 byte 


X+3 


Icon Identifier 


M 


1 byte 


X+4 


Priority 


M 


1 byte 


X+5 to X+7 


PLMN code 


M 


3 bytes 


X+8 to X+9 


LSA Descriptor File Identifier 


M 


2 byte 


X+10 


LSA Descriptor Record Identifier 


M 


1 byte 



LSA name 

Contents: LSA name string to be displayed when the ME is camped in the corresponding area, dependant on the 
contents of the LSA indication for idle mode field. 

Coding: the string shall use either 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [12] with bit 8 set to 0. The alpha identifier 
shall be left justified. Unused bytes shall be set to 'FF'; or 

one of the UCS2 coded options as defined in annex B. 

Configuration parameters 

Contents: Icon qualifier, control of idle mode support and control of LSA indication for idle mode. 

Coding: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Icon qualifier 

Idle mode support 

LSA indication for idle mode 

RFU 



Icon qualifier: 

Contents: The icon qualifier indicates to the ME how the icon is to be used. 
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b2, bl : 00: icon is not to be used and may not be present 

01: icon is self-explanatory, i.e. if displayed, it replaces the LSA name 

10: icon is not self-explanatory, i.e. if displayed, it shall be displayed together with the LSA name 

11:RFU 

Idle mode support: 

Contents: The idle mode support is used to indicate whether the ME shall favour camping on the LSA cells in 
idle mode. 

b3 = 0: Idle mode support disabled 
b3 = 1 : Idle mode support enabled 

LSA indication for idle mode: 

Contents: The LSA indication for idle mode is used to indicate whether or not the ME shall display the LSA 
name when the ME is camped on a cell within the LSA. 

b4 = 0: LSA indication for idle mode disabled 
b4 = 1 : LSA indication for idle mode enabled 

Bits b5 to b8 are RFU (see clause 9.3). 

Icon Identifier 

Contents: The icon identifier addresses a record in EFimg- 

Coding: binary. 

Priority 

Contents: Priority of the LSA which gives the ME the preference of this LSA relative to the other LSAs. 

Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














L 


-^ 


-JL 


-L- 


Priority 
RFU 



'0' is lowest priority, 'F' is highest. 

PLMN code 

Contents: MCC + MNC for the LSA. 

Coding: according to GSM 04.08 [15] and EFloci- 

LSA Descriptor File Identifier: 

Contents: these bytes identify the EF which contains the LSA Descriptors forming the LSA. 

Coding: byte Xh-8: high byte of the LSA Descriptor file; 
byte X+9: low byte of the LSA Descriptor file. 

LSA Descriptor Record Identifier: 

Contents: this byte identifies the number of the first record in the LSA Descriptor file forming the LSA. 

Coding: binary. 
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1 0.4.1 .3 LSA Descriptor files 

Residing under DFsolsa^ there may be several LSA Descriptor files. These EFs contains one or more records again 
containing LSA Descriptors forming the LS As. LS As can be described in four different ways. As a list of LSA IDs, as a 
list of LAC + CIs, as a list of CIs or as a list of LACs. As the basic elements (LSA ID, LAC + CI, CI and LAC) of the 
four types of lists are of different length, they can not be mixed within one record. Different records may contain 
different kinds of lists within the EFs. Examples of codings of LSA Descriptor files can be found in annex F. 



Identifier: '4FXX' Structure: 


linear fixed 


Optional 


Record length: n*X+2 bytes 


Update activity 


: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


LSA descriptor type and number 


M 


1 byte 


2 to X+1 


1"' LSA Descriptor 


M 


X bytes 


X+2 to 2X+1 


2™ LSA Descriptor 


M 


X bytes 










(n-irX+2to 
n*X+1 


n'" LSA Descriptor 


M 


X bytes 


n*X+2 


Record Identifier 


M 


1 byte 



LSA descriptor type and number: 

Contents: The LSA descriptor type gives the format of the LSA descriptor and the number of valid LSA 
Descriptors within the record. 

Coding: 



LSA descriptor type 
Number of LSA Descriptors 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


















1 1 





























LSA descriptor type: 

Contents: Gives the format of the LSA Descriptors. 

b2,bl: 00: LSA ID. 

01: LAC + CI 
10: CI 
11: LAC 

Number of LSA Descriptors: 

Contents: Gives the number of valid LSA Descriptors in the record. 

Coding: binary, with b8 as MSB and b3 as LSB leaving room for 64 LSA Descriptors per record. 

LSA Descriptor 

Contents: Dependant of the coding indicated in the LSA descriptor type: 

in case of LSA ID the field length 'X' is 3 bytes; 
- in case of LAC + CI the field length 'X' is 4 bytes; 

in case of CI the field length 'X' is 2 bytes; 

in case of LAC the field length 'X' is 2 bytes. 
Coding: according to TS 04.08 [15]. 
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Record Identifier: 

Contents: This byte identifies the number of the next record containing the LSA Descriptors forming the LSA. 

Coding: record number of next record. 'FF' identifies the end of the chain. 

This file utihses the concept of chaining as for EFexti- 

The identifier '4FXX' shall be different from one LSA Descriptor file to the other and different from the identifiers of 
EFsai and EFsll- For the range of 'XX', see clause 6.6. 

1 0.4.2 Contents of files at the MExE level 

This clause specifies the EFs in the dedicated file DFMExE. It only applies if support of MExE by the SIM is supported 

(see TS 23.057 [50]). 

The EFs in the Dedicated File DFMExE contain execution environment related information. 

1 0.4.2.1 EFmexe-st (MExE Service table) 

This EF indicates which MExE services are allocated, and whether, if allocated, the service is activated. If a service is 
not allocated or not activated in the SIM, the ME shall not select this service. 



Identifier: '4F40' Structure: transparent Optional 


File size: X bytes, X > 1 Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Services n°1 to n°4 


M 


1 byte 


2 


Services n°5to n°8 





1 byte 


etc. 








X 


Services (4X-3) to (4X) 





1 byte 



-Services 
Contents 



Operator root public key 
Administrator root public key 
Third party root public key 
RFU 



Service n°1 : 
Service n°2 : 
Service n°3 : 
Service n°4 : 
Coding: 

2 bits are used to code each service: 
first bit = 1 : service allocated 
first bit = 0: service not allocated 

where the first bit is bl, b3, b5 or b7; 
second bit = 1 : service activated 
second bit = 0: service not activated 

where the second bit is b2, b4, b6 or b8. 

Service allocated means that the SIM has the capability to support the service. Service activated means that 
the service is available for the card holder (only valid if the service is allocated). 

The following codings are possible: 

first bit = 0: service not allocated, second bit has no meaning; 
first bit = 1 and second bit = 0: service allocated but not activated; 
first bit = 1 and second bit = 1 : service allocated and activated. 

The bits for services not yet defined shall be set to RFU. For coding of RFU see clause 9.3. 
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First byte: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Service n°l 

Service n°2 

Service n°3 

Service n°4 



etc. 
For an example of coding see clause 10.3.7 

1 0.4.2.2 EFoRPK (Operator Root Public Key) 

This EF contains the descriptor(s ) of certificates containing the Operator Root Public Key. This EF shall only be 
allocated if the operator wishes to verify applications and certificates in the MExE operator domain using a root public 
key held on the SIM. Each record of this EF contains one certificate descriptor. 

For example, Operator may provide a second key for recover disaster procedure in order to limit OTA data to load. 



Identifier: '4F41 ' Structure: linear fixed 


Optional 


Record length : X + 10 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/O 


Length 


1 


Parameters indicator 


M 


1 byte 


2 


Flags 


M 


1 byte 


3 


Type of certificate 


M 


1 byte 


4 to 5 


Key/certificate file identifier 


M 


2 bytes 


6 to 7 


Offset into key/certificate file 


M 


2 bytes 


8 to 9 


Length of key/certificate data 


M 


2 bytes 


10 


Key identifier length (k) 


M 


1 byte 


11 tolO+k 


Key identifier 


M 


k bytes 



Parameter indicator 
Contents: 

The parameter indicator indicates if record is full and which optional parameters are present 
Coding: bit string 



Certificate descriptor is valid (bitl=0 key 

descriptor is valid) 

Reserved bit set to 1 (bitx=0 optional parameter 

present) 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

























































Flags 
Contents: 

The authority flag indicates whether the certificate identify an authority (i.e. CA or AA) or not. 
Coding: bit string 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Authority certificate (bit=l certificate of an 

authority) 

RFU 

RFU 
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Type of certificate 
Contents: 

This field indicates the type of certificate containing the key. 
Coding: binary : 

:WTLS 

1 : X509 

2 :X9.68 

Other values are reserved for further use 

Key/certificate File Identifier 
Contents: 

these bytes identify an EF which is the key/certificate data file (see clause 10.7.5), holding the actual 

key/certificate data for this record. 
Coding: 

byte 4: high byte of Key/certificate File Identifier; 

byte 5: low byte of Key/certificate File Identifier. 

Offset into Key/certificate File 
Contents: 

these bytes specify an offset into the transparent key/certificate data File identified in bytes 4 and 5. 
Coding: 

byte 6: high byte of offset into Key/certificate Data File; 

byte 7: low byte of offset into Key/certificate Data File 

Length of Key/certificate Data 
Contents: 

these bytes yield the length of the key/certificate data, starting at the offset identified in "Offset into 

Key/certificate File" field. 
Coding: 

byte 8: high byte of Key/certificate Data length; 

byte 9: low byte of Key/certificate Data length. 

Key identifier length 
Contents: 

This field gives length of key identifier 
Coding: 

binary 

Key identifier 
Contents: 

This field provides a means of identifying certificates that contain a particular public key (chain building) and 

linking the public key to its corresponding private key. For more information about value and using see 

TS 23.057 [50]. 
Coding: 

octet string 

NOTE: transparent key/certificate data longer than 256 bytes may be read using successive READ BINARY 
commands. 
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1 0.4.2.3 EFarpk (Administrator Root Public Key) 

This EF contains the descriptor(s ) of certificates containing the Administrator Root Public Key. This EF shall only be 
allocated if the SIM issuer wishes to control the Third Party certificates on the terminal using an Administrator Root 
Public Key held on the SIM. Each record of this EF contains one certificate descriptor. 

This file shall contain only one record. 



Identifier: '4F42' Structure: linear fixed 


Optional 


Record length: X + 1 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 Length 


1 


Parameters indicator 


M 


1 byte 


2 


Flags 


M 


1 byte 


3 


Type of certificate 


M 


1 byte 


4 to 5 


Key/certificate file identifier 


M 


2 bytes 


6 to 7 


Offset into key/certificate file 


M 


2 bytes 


8 to 9 


Length of key/certificate data 


M 


2 bytes 


10 


Key identifier length (k) 


M 


1 byte 


11 tolO+k 


Key identifier 


M 


k bytes 



For contents and coding of all data items see the respective data items of the EpQj^pj^ (clause 10.4.2. 1). 

10.4.2.4 EFtprpk (Third Party Root Public key) 

This EF contains descriptor(s ) of certificates containing the Third Party Root Public key (s). This EF shall only be 
allocated if the SIM issuer wishes to verify applications and certificates in the MExE Third Party domain using root 
public key(s) held on the SIM. This EF can contain one or more root public keys. Each record of this EF contains one 
certificate descriptor. 

For example, an operator may provide several Third Party root public keys. 



Identifier: '4F43' Structure: linear fixed Optional 


Record length : X + 10 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Parameters indicator 


M 


1 byte 


2 


Flags 


M 


1 byte 


3 


Type of certificate 


M 


1 byte 


4 to 5 


Key/certificate file identifier 


M 


2 bytes 


6 to 7 


Offset into key/certificate file 


M 


2 bytes 


8 to 9 


Length of key/certificate data 


M 


2 bytes 


10 


Key identifier length (k) 


M 


1 byte 


11 tolO+k 


Key identifier 


M 


k bytes 


11+kto11+k 


Certificate identifier length (m) 


M 


1 byte 


12+kto 
11+k+m 


Certificate identifier 


M 


m bytes 
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- Certificate identifier length 
Contents: 

This field gives length of certificate identifier 
Coding: 

binary 

Certificate identifier 
Contents: 

This field identify the issuer and provide a easy way to find a certificate. For more information about value 

and usage, see TS 23.057 [50]. 
Coding: 

Octet string 

For contents and coding of all other data items see the respective data items of the EFqj^p^ (clause 10.7.1). 

1 0.4.2.5 Trusted Key/Certificates Data Files 

Residing under DFmexe, there may be several key/certificates data files. These EFs containing key/certificates data shall 
have the following attributes: 



Identifier: '4FXX' 






Structure 


transparent 


Optional 


Record length: 


Y bytes 






Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 






CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 toY 


Key/Certicates Data 


M 


Y bytes 



Contents and coding: 

Key/certificate data are accessed using the key/certificates descriptors provided by EFtprpk (see clause 
10.4.2.4). 

The identifier '4FXX' shall be different from one key/certificate data file to the other. For the range of 'XX', see clause 
6.6. The length Y may be different from one key/certificate data file to the other. 

1 0.5 Contents of files at the telecom level 

The EFs in the Dedicated File DFtelecom contain service related information. 

1 0.5.1 EFadn (Abbreviated dialling numbers) 

This EF contains Abbreviated Dialling Numbers (ADN) and/or Supplementary Service Control strings (SSC). In 
addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records. It may also 
contain an associated alpha-tagging. 



£75/ 



3GPP TS 51.011 version 4.4.0 Release 4 



82 



ETSI TS 151 Oil V4.4.0 (2002-06) 



Identifier: '6F3A' Structure: linear fixed Optional 


Record length: X+14 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE CHV2 
REHABILITATE CHV2 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration Identifier 


M 


1 byte 


X+14 


Extension 1 Record Identifier 


M 


1 byte 



Alpha Identifier 
Contents: 

Alpha-tagging of the associated dialling number. 
Coding: 

this alpha-tagging shall use either 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [12] with bit 8 set to 0. The alpha 
identifier shall be left justified. Unused bytes shall be set to 'FF'; or 

one of the UCS2 coded options as defined in annex B. 

NOTE 1 : The value of X may be from zero to 241 . Using the command GET RESPONSE the ME can determine 
the value of X. 

Length of BCD number/SSC contents 



Contents: 

this byte gives the number of bytes of the following two data items containing actual BCD number/SSC 
information. This means that the maximum value is 1 1, even when the actual ADN/SSC information 
length is greater than 11. When an ADN/SSC has extension, it is indicated by the extension! identifier 
being unequal to 'FF'. The remainder is stored in the EFgj^jj with the remaining length of the additional 
data being coded in the appropriate additional record itself (see clause 10.5.10). 

Coding: 

according to TS 04.08 [15]. 
- TON and NPI 
Contents: 

Type of number (TON) and numbering plan identification (NPI). 

Coding: 

according to TS 04.08 [15]. If the Dialling Number/SSC String does not contain a dialling number, e.g. a 
control string deactivating a service, the TON/NPI byte shall be set to 'FF' by the ME (see note 2). 

NOTE 2: If a dialling number is absent, no TON/NPI byte is transmitted over the radio interface (see 

TS 04.08 [15]). Accordingly, the ME should not interpret the value 'FF' and not send it over the radio 
interface. 
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b8 


b7 


b5 


b5 


b4 


b3 


b2 


bl 
















1 


1 


1 


1 


NPI 












TON 




















1 



Dialling Number/SSC String 



Contents: 



up to 20 digits of the telephone number and/or SSC information. 



Coding: 



according to TS 04.08 [15] , TS 22.030 [8] and the extended BCD-coding (see table 12). If the telephone 
number or SSC is longer than 20 digits, the first 20 digits are stored in this data item and the remainder is 
stored in an associated record in the EFexti- The record is identified by the Extensionl Record Identifier. 
If ADN/SSC require less than 20 digits, excess nibbles at the end of the data item shall be set to 'F'. 
Where individual dialled numbers, in one or more records, of less than 20 digits share a common 
appended digit string the first digits are stored in this data item and the common digits stored in an 
associated record in the EFexti- The record is identified by the Extension 1 Record Identifier. Excess 
nibbles at the end of the data item shall be set to 'F'. 



Byte X+3 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 1 



MSB of Digit 1 
LSB of Digit 2 



MSB of Digit 2 



Byte X+4: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 3 



MSB of Digit 3 
LSB of Digit 4 



MSB of Digit 4 



etc. 

Capability/Configuration Identifier 

Contents: 

capability/configuration identification byte. This byte identifies the number of a record in the EF(-;f;p 
containing associated capability/configuration parameters required for the call. The use of this byte is 
optional. If it is not used it shall be set to 'FF'. 

Coding: 

binary. 

Extensionl Record Identifier 



Contents: 



extensionl record identification byte. This byte identifies the number of a record in the EFexti containing 
an associated called party subaddress or additional data. The use of this byte is optional. If it is not used it 
shall be set to 'FF'. 
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If the ADN/SSC requires both additional data and called party subaddress, this byte identifies the 
additional record. A chaining mechanism inside EFexti identifies the record of the appropriate called 
party subaddress (see clause 10.5.10). 

Coding: 

binary. 

NOTE 3: As EFadn is part of the DFtelecom it may be used by GSM and also other applications in a 

multi-application card. If the non-GSM application does not recognize the use of Type of Number (TON) 
and Number Plan Identification (NPI), then the information relating to the national dialling plan must be 
held within the data item dialling number/SSC and the TON and NPI fields set to UNKNOWN. This 
format would be acceptable for GSM operation and also for the non-GSM application where the TON and 
NPI fields shall be ignored. 

EXAMPLE: SIM storage of an International Number using E.164 [19] numbering plan. 

TON NPI Digit field 



GSM appUcation 001 

Other application compatible with GSM 000 



0001 abc... 
0000 XXX.. .abc. 



where "abc..." denotes the subscriber number digits (including its country code), and "xxx..." 
denotes escape digits or a national prefix replacing TON and NPI. 

NOTE 4: When the ME acts upon the EF^^f^ with a SEEK command in order to identify a character string in the 
alpha-identifier, it is the responsibility of the ME to ensure that the number of characters used as SEEK 
parameters are less than or equal to the value of X if the MMI allows the user to offer a greater number. 

Table 12: Extended BCD coding 



BCD Value 


Character/Meaning 


'0' 


"0" 






'9' 


"9" 


'A' 


"*" 


'B' 


"#" 


'C 


DTMF Control digit separator (TS 02.07 [3]) 


'D' 


"Wild" value 

This will cause the IVIMI to prompt the user for a single digit (see 

TS 02.07 [3]). 


'E' 


Expansion digit ("Shift Key"). 

It has the effect of adding '10' to the following digit. The following BCD digit 
will hence be interpreted in the range of '10'-'1 E'. The purpose of digits in 
this range is for further study. 


'F' 


Endmark 

e.g. in case of an odd number of digits 



BCD values 'C, 'D' and 'E' are never sent across the radio interface. 

NOTE 5: The interpretation of values 'D', 'E' and 'F' as DTMF digits is for further study. 

NOTE 6: A second or subsequent 'C BCD value will be interpreted as a 3 second PAUSE (see TS 02.07 [3]). 
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1 0.5.2 EFfdn (Fixed dialling numbers) 



This EF contains Fixed Dialling Numbers (FDN) and/or Supplementary Service Control strings (SSC). In addition it 
contains identifiers of associated network/bearer capabilities and identifiers of extension records. It may also contain an 
associated alpha-tagging. 



Identifier: '6F3B' Structure: linear fixed Optional 


Record length: X+14 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV2 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Dialling Number/SSC String 


M 


10 bytes 


X+1 3 


Capability/Configuration Identifier 


M 


1 byte 


X+14 


Extension2 Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of the EFadn (clause 10.5.1), with the exception 
that extension records are stored in the EFext2- 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 

EFadn- 

1 0.5.3 EFsMs (Short messages) 

This EF contains information in accordance with TS 23.040 [13] comprising short messages (and associated 
parameters) which have either been received by the MS from the network, or are to be used as an MS originated 

message. 



Identifier: '6F3C' 




Structure: 


linear fixed Optional 


Record length: 


176 bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
CHV1 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 


Status 


M 


1 byte 


2 to 176 


Remainder 


M 


175 bytes 



Status 
Contents: 



Status byte of the record which can be used as a pattern in the SEEK command. For MS originating 
messages sent to the network, the status shall be updated when the MS receives a status report, or sends a 
successful SMS Command relating to the status report. 



Coding: 
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b8 b7 b5 b5 b4 b3 b2 bl 



—\ — — I — — r 

X X free space 

XXI used space 

1 message received by MS from network; message read 

Oil message received by MS from network; message to be 

read 

111 MS originating message; message to be sent 

RFU (see clause 9.3) 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














1 
X 


1 

X 


1 
1 


1 




1 
1 




















1 





1 

















1 


1 





1 














1 





1 





1 














1 


1 


1 





1 



1 MS originating message; message sent to the network: 

status report not requested 

status report requested but not (yet) received; 

status report requested, received but not stored 

in EF-SMSR; 

status report requested, received and stored 

in EF-SMSR; 

RFU (see clause 9.3) 



Remainder 



Contents: 



This data item commences with the TS-Service-Centre-Address as specified in TS 24.01 1 [16]. The bytes 
immediately following the TS-Service-Centre-Address contain an appropriate short message TPDU as 
specified in TS 23.040 [13], with identical coding and ordering of parameters. 



Coding: 



according to TS 23.040 [13] and TS 24.011 [16]. Any TP-message reference contained in an MS 
originated message stored in the SIM, shall have a value as follows: 



message to be sent: 
message sent to the network: 



Value of the TP-message-reference: 

'FF' 

the value of TP -Message-Reference used in the 

message sent to the network. 



Any bytes in the record following the TPDU shall be filled with 'FF'. 

It is possible for a TS-Service-Centre-Address of maximum permitted length, e.g. containing more than 18 
address digits, to be associated with a maximum length TPDU such that their combined length is 176 bytes. 
In this case the ME shall store in the SIM the TS-Service-Centre-Address and the TPDU in bytes 2-176 
without modification, except for the last byte of the TPDU, which shall not be stored. 

1 0.5.4 Capability configuration parameters 
10.5.4.1 EFccp (Capability configuration parameters) 

This EF contains parameters of required network and bearer capabilities and ME configurations associated with a call 
established using an abbreviated dialling number, a fixed dialling number, an MSISDN, a last number dialled, a service 
dialling number or a barred dialling number. 

For compatibility reasons, this file may be present for release 98 or earlier MEs in order to support Capability 
Configuration Parameters service. 
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Identifier: '6F3D' Structure: linear fixed Optional 


Record length: 14 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 10 


Bearer capability information element 


M 


1 bytes 


11 to 14 


Bytes reserved - see below 


M 


4 bytes 



Bearer capability information element 

Contents and Coding: 

see TS 04.08 [15]. The Information Element Identity (lEI) shall be excluded, i.e. the first byte of the 
EFccp record shall be Length of the bearer capability contents. 

Bytes 11-14 shall be set to 'FF' and shall not be interpreted by the ME. 

10.5.4.2 EFeccp (Extended Capability Configuration Parameters) 

This EF contains parameters of required network and bearer capabilities and ME configurations associated with a call 
established using an abbreviated dialling number, a fixed dialling number, an MSISDN, a last number dialled, a service 
dialling number, a barred dialling number, a mailbox dialling number or a call forwarding indication status number. 

The number of records of the EFeccp shall be equal to the number of records of the EFccp- Each record of the EFccp 
shall have a corresponding record in the EFeccp with the same record number. 

If an ME has to update a record, then the ME shall update each record of both files, EFccp with 10 bytes and EFeccp 
with X bytes (X>15). 

If an ME has to read a record, then the ME shall check the consistency between the record of the EFeccp and the 
corresponding record of the EFccp and update the record of the EFeccp with the value of the corresponding record of the 

EFcpp. 



Identifier: '6F4F' 




Structure: linear 


fixed 




Optional 


Record length: 


X(X>15) 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
CHV1 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 toX 


Bearer capability information element 


M 


X bytes 



Bearer capability information element 

Contents and Coding: 

see TS 24.008 [47]. The Information Element Identity (lEI) shall be excluded, i.e. the first byte of the 
EFeccp record shall be Length of the bearer capability contents. 

Unused bytes are filled with 'FF'. 



10.5.5 EF 



MSISDN 



(MSISDN) 



This EF contains MSISDN(s) related to the subscriber. In addition it contains identifiers of associated network/bearer 
capabilities and identifiers of extension records. It may also contain an associated alpha-tagging. 
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Identifier: '6F40' Structure: linear fixed Optional 


Record length: X+14 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration Identifier 


M 


1 byte 


X+14 


Extension 1 Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of EFadn- 

NOTE 1: If the SIM stores more than one MSISDN number and the ME displays the MSISDN number(s) within 
the initialization procedure then the one stored in the first record shall be displayed with priority. 

NOTE 2: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 

EFadn- 

1 0.5.6 EFsMSP (Short message service parameters) 

This EF contains values for Short Message Service header Parameters (SMSP), which can be used by the ME for user 
assistance in preparation of mobile originated short messages. For example, a service centre address will often be 
common to many short messages sent by the subscriber. 

The EF consists of one or more records, with each record able to hold a set of SMS parameters. The first (or only) 
record in the EF shall be used as a default set of parameters, if no other record is selected. 

To distinguish between records, an alpha-identifier may be included within each record, coded on Y bytes. 

The SMS parameters stored within a record may be present or absent independently. When a short message is to be sent 
from the MS, the parameter in the SIM record, if present, shall be used when a value is not supplied by the user. 



Identifier: '6F42' Structure: linear fixed Optional 


Record length: 28+Y bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 toY 


Alpha-Identifier 





Y bytes 


Y+1 


Parameter Indicators 


M 


1 byte 


Y+2toY+13 


TP-Destination Address 


M 


1 2 bytes 


Y+14toY+25 


TS-Service Centre Address 


M 


1 2 bytes 


Y+26 


TP-Protocol Identifier 


M 


1 byte 


Y+27 


TP-Data Coding Scheme 


M 


1 byte 


Y+28 


TP-Validity Period 


M 


1 byte 



Storage is allocated for all of the possible SMS parameters, regardless of whether they are present or absent. Any bytes 
unused, due to parameters not requiring all of the bytes, or due to absent parameters, shall be set to 'FF'. 

Alpha-Identifier 

Contents: 
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Alpha Tag of the associated SMS-parameter. 
Coding: 

see clause 10.5.1 (EFadn)- 

NOTE: The value of Y may be zero, i.e. the alpha-identifier facility is not used. By using the command GET 
RESPONSE the ME can determine the value of Y. 

Parameter Indicators 

Contents: 

Each of the default SMS parameters which can be stored in the remainder of the record are marked absent 
or present by individual bits within this byte. 

Coding: 

Allocation of bits: 

Bit number Parameter indicated 



1 


TP-Destination Address 


2 


TS-Service Centre Address 


3 


TP -Protocol Identifier 


4 


TP-Data Coding Scheme 


5 


TP-Validity Period 


6 


reserved, set to 1 


7 


reserved, set to 1 


8 


reserved, set to 1 


it value 


Meaning 





Parameter present 


1 


Parameter absent 



TP-Destination Address 

Contents and Coding: As defined for SM-TL address fields in TS 23.040 [13]. 
TP-Service Centre Address 

Contents and Coding: As defined for RP-Destination address Centre Address in TS 24.01 1 [16]. 
TP -Protocol Identifier 

Contents and Coding: As defined in TS 23.040 [13]. 
TP-Data Coding Scheme 

Contents and Coding: As defined in TS 23.038 [12]. 
- TP-Validity Period 

Contents and Coding: As defined in TS 23.040 [13] for the relative time format. 

10.5.7 EFsMss (SMS status) 

This EF contains status information relating to the short message service. 

The provision of this EF is associated with EFsms- Both files shall be present together, or both absent from the SIM. 
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Identifier: '6F43' Structure: transparent 


Optional 


File size: 2+X bytes Update activity 


: low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Last Used TP-MR 


M 


1 byte 


2 


SMS "Memory Cap. Exceeded" Not. Flag 


M 


1 byte 


3 to 2+X 


RFU 





X bytes 



Last Used TP-MR. 

Contents: 

the value of the TP-Message-Reference parameter in the last mobile originated short message, as defined 
in TS 23.040 [13]. 

Coding: 

as defined in TS 23.040 [13]. 

SMS "Memory Capacity Exceeded" Notification Flag. 

Contents: 

This flag is required to allow a process of flow control, so that as memory capacity in the MS becomes 
available, the Network can be informed. The process for this is described in TS 23.040 [13]. 

Coding: 

bl=l means flag unset; memory capacity available 

bl=0 means flag set 

b2 to b8 are reserved and set to 1 . 



1 0.5.8 EFlnd (Last number dialled) 



This EF contains the last numbers dialled (LND) and/or the respective supplementary service control strings (SSC). In 
addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records. It may also 
contain associated alpha-tagging. 



Identifier: '6F44' Structure: cyclic 


Optional 


Record length: X+14 bytes Update activity 


low 


Access Conditions: 

READ CHV1 
UPDATE CHV1 
INCREASE NEVER 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Dialling Number/SSC String 


M 


10 bytes 


X+1 3 


Capability/Configuration Identifier 


M 


1 byte 


X+14 


Extension 1 Record Identifier 


M 


1 byte 
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For contents and coding, see clause 10.5.1 EFadn- 

The value of X in EFlnd may be different to both the value of X in EFadn and of X in EFfdn- 

If the value of X in EFlnd is longer than the length of the a-tag of the number to be stored, then the ME shall pad the 
a-tag with 'FF'. If the value of X in EFlnd is shorter than the length of the a-tag of the number to be stored, then the ME 
shall cut off excessive bytes. 

10.5.9 EFsDN (Service Dialling Numbers) 

This EF contains special service numbers (SDN) and/or the respective supplementary service control strings (SSC). In 
addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records. It may also 
contain associated alpha-tagging. 



Identifier: '6F49' Structure: linear fixed Optional 


Record length: X+14 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1-X 


Alpha identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 bytes 


X+2 


TON and NPI 


M 


1 byte 


X+3-X+12 


Dialling Number/SSC String 


M 


10 bytes 


X+1 3 


Capability/Configuration Identifier 


M 


1 byte 


X+14 


Extensions Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of the EFadn (clause 10.5.1), with the exception 
that extension records are stored in the EFexts- 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 

EFadn- 

10.5.10 EFexti (Extensioni) 

This EF contains extension data of an ADN/SSC, an MSISDN, or an LND. Extension data is caused by: 

- an ADN/SSC (MSISDN, LND) which is greater than the 20 digit capacity of the ADN/SSC (MSISDN, LND) 
Elementary File or where common digits are required to follow an ADN/SSC string of less than 20 digits. The 
remainder is stored in this EF as a record, which is identified by a specified identification byte inside the 
ADN/SSC (MSISDN, LND) Elementary File. The EXTl record in this case is specified as additional data; 

an associated called party subaddress. The EXTl record in this case is specified as subaddress data. 



Identifier: '6F4A' 


Structure: 


linear fixed 


Optional 


Record length: 13 byte 


s 


Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
CHV1 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


11 bytes 


13 


Identifier 


M 


1 byte 



Record type 
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Contents: type of the record 
Coding: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Called Party Subaddress 

Additional data 

RFU 



b3-b8 are reserved and set to 0; 

a bit set to 1 identifies the type of record; 

only one type can be set; 

'00' indicates the type "unknown". 

The following example of coding means that the type of extension data is "additional data": 





b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 




1 1 




1 




1 




1 




1 




1 

1 


1 




ic 


mda 


ta 















Contents: Additional data or Called Party Subaddress depending on record type. 

Coding: 

Case 1, Extensionl record is additional data: 

The first byte of the extension data gives the number of bytes of the remainder of ADN/SSC (respectively 
MSISDN, LND). The coding of remaining bytes is BCD, according to the coding of ADN/SSC 
(MSISDN, LND). Unused nibbles at the end have to be set to 'F'. It is possible if the number of additional 
digits exceeds the capacity of the additional record to chain another record inside the EXTl Elementary 
File by the identifier in byte 13. In this case byte 2 (first byte of the extension data) of all records for 
additional data within the same chain indicates the number of bytes ('01' to 'OA') for ADN/SSC 
(respectively MSISDN, LND) within the same record unequal to 'FF'. 

Case 2, Extensionl record is Called Party Subaddress: 

The subaddress data contains information as defined for this purpose in TS 04.08 [15]. All information 
defined in TS 04.08, except the information element identifier, shall be stored in the SIM. The length of 
this subaddress data can be up to 22 bytes. In those cases where two extension records are needed, these 
records are chained by the identifier field. The extension record containing the first part of the called 
party subaddress points to the record which contains the second part of the subaddress. 

Identifier 

Contents: identifier of the next extension record to enable storage of information longer than 1 1 bytes. 

Coding: record number of next record. 'FF' identifies the end of the chain. 

EXAMPLE: Of a chain of extension records being associated to an ADN/SSC. The extensionl record identifier 
(Byte 14+X) of EFadn is set to 3. 
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No of Record 



Type 



Extension Data 



Next 



Record 



Record 3 
Record 4 
Record 5 
Record 6 



■02' 
'xx' 
'01' 
'01' 



XX XX 

XX XX 

XX XX 

XX XX 



'06' ^- 

'xx' 

■FF' -*- 

'05' -^ 



In this example ADN/SSC is associated to additional data (records 3 and 4) which represent the last 27 or 28 digits of 
the whole ADN/SSC (the first 20 digits are stored in EFadn) and a called party subaddress whose length is more than 11 
bytes (records 6 and 1). 

10.5.11 EFext2 (Extension2) 

This EF contains extension data of an FDN/SSC (see EXT2 in clause 10.5.2). 



Identifier: '6F4B' 


Structure: 


linear fixed 


Optional 


Record length: 13 byte 


s 


Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
CHV2 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


11 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see clause 10.5.10 EFexti- 



1 0.5.1 2 EFext3 (Extensions) 

This EF contains extension data of an SDN (see EXT3 in clause 10.5.9). 



Identifier: '6F4C' 


Structure: 


linear fixed 


Optional 


Record length: 13 byte 


s 


Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


1 1 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see clause 10.5.10 EFexti. 

10.5.13 EFbdn (Barred Dialling Numbers) 

This EF contains Barred Dialling Numbers (BDN) and/or Supplementary Service Control strings (SSC). In addition it 
contains identifiers of associated network/bearer capabilities and identifiers of extension records. It may also contain an 
associated alpha-tagging. 
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Identifier: '6F4D' Structure: linear fixed Optional 


Record length: X+15 bytes Update activity: low 


Access Conditions: 

READ CHV1 

UPDATE CHV2 

INVALIDATE CHV2 / ADM (set at personalisation) 

REHABILITATE CHV2 / ADM (set at personalisation) 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration Identifier 


M 


1 byte 


X+1 4 


Extension4 Record Identifier 


M 


1 byte 


X+15 


Comparison Method Pointer 


M 


1 byte 



For contents and coding of all data items, except for the Comparison Method Pointer, see the respective data items of 
the EFadn (clause 10.5.1), with the exception that extension records are stored in the EFext4- The Comparison Method 
Pointer refers to a record number in EFcmi- 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 

EFadn- 

1 0.5.1 4 EFext4 (Extension4) 

This EF contains extension data of an BDN/SSC (see EXT4 in clause 10.5.13). 



Identifier: '6F4E' 


Structure: linear fixed 


Optional 


Record length: 13 byte 


s Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
CHV2 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


11 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see clause 10.5.10 EFexti- 

1 0.5.1 5 EFsMSR (Short message status reports) 

This EF contains information in accordance with TS 23.040 [13] comprising short message status reports which have 
been received by the MS from the network. 

Each record is used to store the status report of a short message in a record of EFsms- The first byte of each record is the 
link between the status report and the corresponding short message in EFsms- 
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Identifier: '6F47' 


Structure: 


linear fixed 




Optional 


Record length: 30 bytes 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


CHV1 
CHV1 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 


SMS record identifier 


M 


1 


2-30 


SMS status report 


M 


29 bytes 



- SMS record identifier 

Contents: 

This data item identifies the corresponding SMS record in EFsms^ e.g. if this byte is coded '05' then this 
status report corresponds to the short message in record #5 of EFsms- 

Coding: 

'00' - empty record 

'01' - 'FF' - record number of the corresponding SMS in EFsms- 

- SMS status report 

Contents: 

This data item contains the SMS-STATUS -REPORT TPDU as specified in TS 23.040 [13], with identical 
coding and ordering of parameters. 

Coding: 

according to TS 23.040 [13]. Any bytes in the record following the TPDU shall be filled with 'FF'. 

1 0.5.1 6 EFcMi (Comparison Method Information) 

This EF contains a list of Comparison Method Identifiers and alpha-tagging associated with BDN entries (see EFbdn)- 
This EF shall always be present if EFbdn is present. 



Identifier: '6F58' Structure: linear fixed Optional 


Record length: X+^ bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


M 


X bytes 


X+1 


Comparison Method Identifier 


M 


1 byte 



Alpha Identifier 
Contents: 

Alpha-tagging of the associated Comparison Method Identifier 
Coding: 

Same as the alpha identifier in EFadn- 
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Comparison Method Identifier 

Contents: 

this byte describes the comparison method which is associated with a BDN record. Its interpretation is not 
specified but it shall be defined by the operators implementing the BDN feature. 

Coding: 

'00' - 'FE' = Comparison Method Identifier. 

'FF' = Default method. 

1 0.6 DFs at the telecom level 

DFs may be present as child directories of DFtelecom- The following has been defined. 
DFgraphics '5F50' 

1 0.6.1 Contents of files at the telecom graphics level 

The EFs in the Dedicated File DFgraphics contain graphical information. 

10.6.1.1 EFiMG (image) 

Each record of this EF identifies instances of one particular graphical image, which graphical image is identified by this 
EF's record number. 

Image instances may differ as to their size, having different resolutions, and the way they are coded, using one of 
several image coding schemes. 

As an example, image k may represent a company logo, of which there are i instances on SIM, of various resolutions 
and perhaps encoded in several image coding schemes. Then, the i instances of the company's logo are described in 
record k of this EF. 



Identifier: '4F20' Structure: linear fixed Optional 


Record length: 9n+2 bytes Update activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Number of Actual Image Instances 


M 


1 byte 


2 to 10 


Descriptor of Image Instance 1 


M 


9 bytes 


11 to 19 


Descriptor of Image Instance 2 





9 bytes 


: 








9(n-1) + 2to 
9n + 1 


Descriptor of Image Instance n 





9 bytes 


9n + 2 


RFU 





1 byte 



Number of Actual Image Instances 

Contents: this byte gives the number of actual image instances described in the following data items (i.e. unused 
descriptors are not counted). 

Coding: binary 

Image Instance Descriptor 
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Contents: a description of an image instance 

Coding: see below 

Byte 1 : Image Instance Width 

Contents: 

this byte specifies the image instance width, expressed in raster image points. 

Coding: 

binary. 

Byte 2: Image Instance Height 

Contents: 

this byte specifies the image instance height, expressed in raster image points. 

Coding: 

binary. 

Byte 3: Image Coding Scheme 

Contents: 

this byte identifies the image coding scheme that has been used in encoding the image instance. 

Coding: 

'11'- basic image coding scheme as defined in annex G; 

'21' - colour image coding scheme as defined in annex G; 

other values are reserved for future use. 

Bytes 4 and 5: Image Instance File Identifier 

Contents: 

these bytes identify an EF which is the image instance data file (see clause 10.6.1.2), holding the 
actual image data for this particular instance. 

Coding: 

byte 4: high byte of Image Instance File Identifier; 

byte 5: low byte of Image Instance File Identifier. 
Bytes 6 and 7: Offset into Image Instance File 
Contents: 

these bytes specify an offset into the transparent Image Instance File identified in bytes 4 and 5. 
Coding: 

byte 6: high byte of offset into Image Instance File; 

byte 7: low byte of offset into Image Instance File 

Bytes 8 and 9: Length of Image Instance Data 

Contents: 

these bytes yield the length of the image instance data, starting at the offset identified in bytes 6 
and 7. 
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Coding: 

byte 8: high byte of Image Instance Data length; 

byte 9: low byte of Image Instance Data length. 

NOTE: Transparent image instance data longer than 256 bytes may be read using successive READ BINARY 
commands. 

1 0.6.1 .2 Image Instance Data Files 

Residing under DFgraphics^ there may be several image instance data files. These EFs containing image instance data 
shall have the following attributes. 



Identifier: '4FXX' 




Structure 


transparent 


Optional 


Record length: 


Y bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 




CHV1 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 toY 


Image Instance Data 


M 


Y bytes 



Contents and coding: 

Image instance data are accessed using the image instance descriptors provided by EFimg (see 
clause 10.6.1.1). 

The identifier '4FXX' shall be different from one image instance data file to the other. For the range of 'XX', see clause 
6.6. The length Y may be different from one image instance data file to the other. 

10.7 Files of GSM 

This clause contains a figure depicting the file structure of the SIM. DFqsm shall be selected using the identifier '7F20'. 
If selection by this means fails, then DCS 1800 MEs shall, and optionally GSM MEs may then select DFqsm with 
'7F21'. 

NOTE 1 : The selection of the GSM application using the identifier '7F2 1 ', if selection by means of the identifier 
'7F20' fails, is to ensure backwards compatibility with those Phase 1 SIMs which only support the 
DCS 1800 application using the Phase 1 directory DFdcsisoo coded '7F2r. 

NOTE 2: To ensure backwards compatibility with those Phase 1 DCS 1800 MEs which have no means to select 
DFqsm two options have been specified. These options are given in GSM 09.91 [17]. 
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DFgsm 
'7F20' 



MF 
'3F00' 



DF 



TELECOM 

7F10' 



DFis_4i 
'7F22 ' 



DFpp^cxs 
'7F23' 



see GSM 11.19 



' 6F3A' 



' 6F3B' 



E^SMS 

'6F3C' 



EF 



SMSP 

6F42 ' 



EF 



SMSS 

6F43' 



1 6F44' 



EFexti 
' 6F4A' 



EFext2 

' 6F4B' 



E^EXT3 

' 6F4C' 



DF 



GRAPHICS 

'5F50' 



E^lMG 

'4F20' 



'5F30' 



DFglobst 
'5F31 ' 



DFico 
'5F32 ' 



D^ACeS 

'5F33' 



DFeia/TIA-553 

'5F40' 



DFcTs 
'5F60' 



DFsoLSA 

'5F70 ' 



see GSM 11.19 



DFf4E>.E 

'5F3C' 



EFk_ExE-ST 

'4F40 ' 



EFoRPK 
'4F41' 



EFlp 
'6F05' 



FFjMsi 
' 6F07 ' 



EFkc 
' 6F20 ' 



' 6F2C' 



EFcNL 

' 6F32' 



EF^CMmax 

' 6F37 ' 



EFssx 
'6F38' 



EFftCM 
'6F39' 



EFpucT 
' 6F41' 



EFcBMl 

' 6F45' 



EFspH 
' 6F46' 



' 6F48' 



EFppLMN 

' 6F7B' 



EFpoci 
' 6F7E' 



EF^D 
' 6FAD ' 



EFpHASE 

' 6FAE ' 



EFvBs 
' 6FB3' 



EFvBss 
' 6FB4 ' 



EFeMLPP 

' 6FB5' 



EFftAeM 

' 6FB6' 



EFma 
'6F51' 



EFkcGPRS 

' 6F52 ' 



EFpoclGPRS 

'6F53' 



EFsuME 

' 6F54' 



EF 



HPLMNAcT 

' 6F62' 



EF 



CPBCCH 

6F63' 



EF 



INVSCAN 

5F64 ' 



EF 



RPLMNAcT 

6F65' 



EFmbdn 
' 6FC7' 



EFext6 

'6FC8' 



EFhbi 
' 6FC9' 



EFmwis 
' 6FCA' 



EFjcciP 
'2FE2 ' 



EEccp 
' 6F3D' 



EF 



SMSR 

6F47 ' 



EEpDN 

' 6F4D' 



EFsai 
'4F30' 



EFarpk 

'4F42 ' 



EFpLf^I^sel 

'6F30' 



EFqidi 
' 6F3E' 



EFpccH 
' 6F74 ' 



EFvGcs 
' 6FB1 ' 



EFpcc 
' 6FB7 ' 



EF 



PLMNwAcT 

6F60' 



EFpi^i^ 
'6FC5' 



EFcFis 
' 6FCB' 



EFelp 
'2F05' 



EEmsisdn 
' 6F40' 



EFspN 
' 6F49' 



EEexT4 

' 6F4E' 



EFsLL 

'4F31' 



EFtprpk 

'4F43' 



EFhplmn 
' 6F31' 



EFgiQ2 
' 6F3F' 



EFacc 
' 6F78' 



EFvGcss 
' 6FB2' 



EFcpMiR 
'6F50' 



EF 



OPLMNwAcT 

6F61' 



EFqpl 
' 6FC6' 



EFext7 

' 6FCC' 
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EF 



SPDI 

5FCD' 



Figure 8: File identifiers and directory structures of GSIVI 



1 1 Application protocol 



When involved in GSM administrative management operations, the SIM interfaces with appropriate terminal 
equipment. These operations are outside the scope of the present document. 

When involved in GSM network operations the SIM interfaces with an ME with which messages are exchanged. A 
message can be a command or a response. 

A GSM command/response pair is a sequence consisting of a command and the associated response. 

A GSM procedure consists of one or more GSM command/response pairs which are used to perform all or part 
of an application-oriented task. A procedure shall be considered as a whole, that is to say that the corresponding 
task is achieved if and only if the procedure is completed. The ME shall ensure that, when operated according to 
the manufacturer's manual, any unspecified interruption of the sequence of command/response pairs which 
realize the procedure, leads to the abortion of the procedure itself. 

A GSM session of the SIM in the GSM application is the interval of time starting at the completion of the SIM 
initialization procedure and ending either with the start of the GSM session termination procedure, or at the first 
instant the link between the SIM and the ME is interrupted. 

During the GSM network operation phase, the ME plays the role of the master and the SIM plays the role of the slave. 

The SIM shall execute all GSM and SIM Application Toolkit commands or procedures in such a way as not to 
jeopardise, or cause suspension, of service provisioning to the user. This could occur if, for example, execution of the 
RUN GSM ALGORITHM is delayed in such a way which would result in the network denying or suspending service to 
the user. 

Some procedures at the SIM/ME interface require MMI interactions. The descriptions hereafter do not intend to infer 
any specific implementation of the corresponding MMI. When MMI interaction is required, it is marked "MMI" in the 
list given below. 

Some procedures are not clearly user dependent. They are directly caused by the interaction of the MS and the network. 
Such procedures are marked "NET" in the list given below. 

Some procedures are automatically initiated by the ME. They are marked "ME" in the list given below. 

The list of procedures at the SIM/ME interface in GSM network operation is as follows: 

General Procedures: 

Reading an EF ME 

- Updating an EF ME 

Increasing an EF ME 

SIM management procedures: 

SIM initialization ME 

GSM session termination ME 

Emergency call codes request ME 

Extended language preference request ME 

Language preference request ME 
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Administrative information request ME 

SIM service table request ME 

SIM phase request ME 
CHV related procedures: 

- CHV verification MMI 

- CHV value substitution MMI 

- CHV disabling MMI 

- CHV enabling MMI 

- CHV unblocking MMI 
GSM security related procedures: 

GSM algorithms computation NET 

- IMSI request NET 
Access control information request NET 
HPLMN search period request NET 
Location Information NET 

- GPRS Location Information NET 

- Cipher key NET 

- GPRS Cipher key NET 

- BCCH information NET 

- Forbidden PLMN information NET 

- LSA information NET 
Subscription related procedures: 

- Dialling Numbers (ADN, FDN, MSISDN, END, SDN, BDN) MMI/ME 

- Short messages (SMS) MMI 

- Advice of Charge (AoC) MMI 

- Capability Configuration Parameters (CCP) MMI 

- PLMN Selector MMI 

- HPLMN Selector with Access Technology MMI 
User controlled PLMN Selector with Access Technology MMI 
Operator controlled PLMN Selector with Access Technology MMI 

- RPLMN last used Access Technology MMI 

- Investigation Scan request NET 

- CPBCCH information NET 

- Cell Broadcast Message Identifier (CBMI) MMI 

- Group Identifier Level 1 (GIDl) MMI/ME 
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- Group Identifier Level 2 (GID2) 
Service Provider Name (SPN) 

- Voice Group Call Service (VGCS) 
Voice Broadcast Service (VBS) 

Enhanced Multi Level Pre-emption and Priority (eMLPP) 
Depersonalisation Control Keys 
Short message status reports (SMSR) 
Network's indication of alerting 
SIM Application Toolkit related procedures: 

- Data Download via SMS-CB (CBMID) 

- Data Download via SMS-PP 
Menu selection 

- Call Control 

- Proactive SIM 

- Mobile Originated Short Message control by SIM 

- Image Request 
MExE related procedures: 

- Reading of MExE_ST 



MMI/ME 

ME 

MMI/ME 

MMI/ME 

MMI/ME 

ME 

MMI 

ME 

NET 

NET 

MMI 

MMI/ME/NET 

MMI/ME/NET 

MMI/ME/NET 

MMI/ME 

ME 



- Reading of root public keys on the SIM (ORPK, ARPK,TPRPK) ME/NET 

The procedures listed in clause 11 .2 are basically required for execution of the procedures in clauses 11.3, 1 1 .4 and 
1 1.5. The procedures listed in clauses 11.3 and 1 1.4 are mandatory (see TS 02.17 [6]). The procedures listed in clause 
11.5 are only executable if the associated services, which are optional, are provided in the SIM. However, if the 
procedures are implemented, it shall be in accordance with clause 1 1.5. 

If a procedure is related to a specific service indicated in the SIM Service Table, it shall only be executed if the 
corresponding bits denote this service as "allocated and activated" (see clause 10.3.7). In all other cases this procedure 
shall not start. 



11.1 General procedures 



Procedures on different types of files shall be in accordance with TS 102 221 [55] with the limitation that the use of 
short file IDs is not supported by the SIM. 



1 1 .2 SIM management procedures 



Phase 2 MEs shall support all SIMs which comply with the mandatory requirements of Phase 1, even if these SIMs do 
not comply with all the mandatory requirements of Phase 2. Furthermore, Phase 2 MEs shall take care of potential 
incompatibilities with Phase 1 SIMs which could arise through use of inappropriate commands or misinterpretation of 
response data. Particular note should be taken of making a false interpretation of RFU bytes in a Phase 1 SIM having 
contradictory meaning in Phase 2; e.g. indication of EF invalidation state. 
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11.2.1 SIM initialization 

After SIM activation (see clause 4.3.2), the ME selects the Dedicated File DpQgjyj and optionally attempts to select 
EFecc If EFecc is available, the ME requests the emergency call codes. 

The ME requests the Extended Language Preference. The ME only requests the Language Preference (EFlp) if at least 
one of the following conditions holds: 

EFpL is not available; 

EFpL does not contain an entry corresponding to a language specified in ISO 639 [30]; 

the ME does not support any of the languages in EFpL. 

If both EFs are not available or none of the languages in the EFs is supported then the ME selects a default language. It 
then runs the CHVl verification procedure. 

If the CHVl verification procedure is performed successfully, the ME then runs the SIM Phase request procedure. 

For a SIM requiring PROFILE DOWNLOAD, then the ME shall perform the PROFILE DOWNLOAD procedure in 
accordance with TS n.14 [27]. When BDN is enabled on a SIM, the PROFILE DOWNLOAD procedure is used to 
indicate to the SIM whether the ME supports the "Call Control by SIM" facility. If so, then the SIM is able to allow the 
REHABILITATE command to rehabilitate EFimsi and EFloci- 

If the ME detects a SIM of Phase 1, it shall omit the following procedures relating to FDN and continue with the 
Administrative Information request. The ME may omit procedures not defined in Phase 1 such as HPLMN Search 
Period request. 

For a SIM of Phase 2 or greater, GSM operation shall only start if one of the two following conditions is fulfilled: 

if EFjvisi and EFloci are not invalidated, the GSM operation shall start immediately; 

if EFimsi and EFloci are invalidated, the ME rehabilitates these two EFs. 

MEs without FDN capability but with Call control by SIM facility shall not rehabilitate EFimsi and/or EFloci if 
FDN is enabled in the SIM and therefore have no access to these EFs. GSM operation will therefore be 
prohibited; 

MEs without FDN capability and without Call control by SIM facility shall not rehabilitate EFimsi and/or EFloci 
and therefore have no access to these EFs. GSM operation will therefore be prohibited. 

It is these mechanisms which are used for control of services n°3 and n°31 by the use of SIMs for these services 
which always invalidate these two EFs at least before the next command following selection of either EF. 

NOTE: When FDN and BDN are both enabled, and if the ME supports FDN but does not support the Call control 
by SIM facility, the rehabilitation of EFimsi and EFloci will not be successful because of a restriction 
mechanism of the REHABILITATE command linked to the BDN feature. 

When EFimsi and EFloci are successfully rehabilitated, if the FDN capability procedure indicates that: 

i) FDN is allocated and activated in the SIM; and FDN is set "enabled", i.e. ADN "invalidated" or not activated; 
and the ME supports FDN; or 

ii) FDN is allocated and activated in the SIM; and FDN is set "disabled", i.e. ADN "not invalidated"; or 

iii) FDN is not allocated or not activated; 

then GSM operation shall start. 

In all other cases GSM operation shall not start. 

Afterwards, the ME runs the following procedures, subject to the service being supported both by the ME and the SIM: 

Administrative Information request; 

- SIM Service Table request; 
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- IMSI request; 
Access Control request; 

- HPLMN Search Period request; 
Investigation scan request; 
PLMN selector request; 

HPLMN Selector with Access Technology request; 
User controlled PLMN Selector with Access Technology request; 
Operator controlled PLMN Selector with Access Technology request; 
RPLMN last used Access Technology request; 

- Location Information request; 
GPRS Location Information request; 
Cipher Key request; 

- GPRS Cipher Key request; 
BCCH information request; 
CPBCCH information request; 
Forbidden PLMN request; 
LSA information request; 

- CBMID request; 

Depersonalisation Control Keys request; 

Network's indication of alerting request. 

If the SIM service table indicates that the proactive SIM service is active, then from this point onwards, the ME, if it 
supports the proactive SIM service, shall send STATUS commands at least every 30s during idle mode as well as 
during calls, in order to enable the proactive SIM to respond with a command. The SIM may send proactive commands 
(see TS 1L14 [27]), including a command to change the interval between STATUS commands from the ME, when in 
idle mode. In-call requirements for STATUS for SIM Presence Detection are unchanged by this command. 

After the SIM initialization has been completed successfully, the MS is ready for a GSM session. 

11.2.2 GSM session termination 

NOTE 1: This procedure is not to be confused with the deactivation procedure in clause 4.3.2. 

The GSM session is terminated by the ME as follows. 

The ME runs all the procedures which are necessary to transfer the following subscriber related information to the SIM, 
subject to the service being supported both by the ME and the SIM: 

Location Information update; 

GPRS Location Information update; 

Cipher Key update; 

- GPRS Cipher Key update; 
BCCH information update; 
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CPBCCH information update; 

RPLMN last used Access Technology update; 

Advice of Charge increase; 

- Forbidden PLMN update. 

As soon as the SIM indicates that these procedures are completed, the ME/SIM link may be deactivated. 

Finally, the ME deletes all these subscriber related information elements from its memory. 

NOTE 2: If the ME has already updated any of the subscriber related information during the GSM Session, and the 
value has not changed until GSM session termination, the ME may omit the respective update procedure. 

1 1 .2.3 Emergency Call Codes 

Request: The ME performs the reading procedure with EFecc- 

Update: The ME performs the updating procedure with EFecc- 

NOTE: The update procedure is only applicable when access conditions of ADM for update is set to ALW, 
CHVl orCHV2. 

1 1 .2.4 Language preference 

Request: The ME performs the reading procedure with EFlp. 

Update: The ME performs the updating procedure with EFlp. 

1 1 .2.5 Administrative information request; 

The ME performs the reading procedure with EFad- 

1 1 .2.6 SIM service table request 

The ME performs the reading procedure with EFsst. 

1 1 .2.7 SIM phase request 

The ME performs the reading procedure with EFphase- 

1 1 .2.8 SIM Presence Detection and Proactive Polling 

As an additional mechanism, to ensure that the SIM has not been removed during a card session, the ME sends, at 
frequent intervals, a STATUS command during each call. A STATUS command shall be issued within all 30 second 
periods of inactivity on the SIM-ME interface during a call. Inactivity in this case is defined as starting at the end of the 
last communication or the last issued STATUS command. If no response data is received to this STATUS command, 
then the call shall be terminated as soon as possible but at least within 5 seconds after the STATUS command has been 
sent. If the DF indicated in response to a STATUS command is not the same as that which was indicated in the previous 
response, or accessed by the previous command, then the call shall be terminated as soon as possible but at least within 
5 seconds after the response data has been received. This procedure shall be used in addition to a mechanical or other 
device used to detect the removal of a SIM. 

If the ME supports the proactive SIM service, and the SIM has this service activated in its Service Table, then during 
idle mode the ME shall send STATUS commands to the SIM at intervals no longer than the interval negotiated with the 
SIM (see TS 11.14 [27]). 
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1 1 .2.9 Preferred Language 



Request: The ME performs the reading procedure with EFpL. 

Update: The ME performs the updating procedure with EFpL. 

1 1 .3 CHV related procedures 

A successful completion of one of the following procedures grants the access right of the corresponding CHV for the 
GSM session. This right is valid for all files within the GSM application protected by this CHV. 

After a third consecutive presentation of a wrong CHV to the SIM, not necessarily in the same GSM session, the CHV 
status becomes "blocked" and if the CHV is "enabled", the access right previously granted by this CHV is lost 
immediately. 

An access right is not granted if any of the following procedures are unsuccessfully completed or aborted. 

11.3.1 CHV verification 

The ME checks the CHV status. 

In the case of CHV 1 the following procedure applies: 

if the CHVl status is "blocked" and CHVl is "enabled", the procedure ends and is finished unsuccessfully; 

if the CHVl status is "blocked" but CHVl is "disabled", the procedure ends and is finished successfully. The 
ME shall, however, accept SIMs which do not grant access rights when CHVl is "blocked" and "disabled". In 
that case ME shall consider those SIMs as "blocked"; 

if the CHVl status is not "blocked" and CHVl is "disabled", the procedure is finished successfully; 

- if the CHVl status is not "blocked" and CHVl is "enabled", the ME uses the VERIFY CHV function. If the 
CHVl presented by the ME is equal to the corresponding CHVl stored in the SIM, the procedure is finished 
successfully. If the CHVl presented by the ME is not equal to the corresponding CHVl stored in the SIM, the 
procedure ends and is finished unsuccessfully. 

In the case of CHV2 the following procedure applies: 

if the CHV2 status is "blocked", the procedure ends and is finished unsuccessfully; 

- if the CHV2 status is not "blocked", the ME uses the VERIFY CHV function. If the CHV2 presented by the ME 
is equal to the corresponding CHV2 stored in the SIM, the procedure is finished successfully. If the CHV2 
presented by the ME is not equal to the corresponding CHV2 stored in the SIM, the procedure ends and is 
finished unsuccessfully. 

11.3.2 CHV value substitution 

The ME checks the CHV status. If the CHV status is "blocked" or "disabled", the procedure ends and is finished 
unsuccessfully. 

If the CHV status is not "blocked" and the enabled/disabled indicator is set "enabled", the ME uses the CHANGE CHV 
function. If the old CHV presented by the ME is equal to the corresponding CHV stored in the SIM, the new CHV 
presented by the ME is stored in the SIM and the procedure is finished successfully. 

If the old CHV and the CHV in memory are not identical, the procedure ends and is finished unsuccessfully. 

11.3.3 CHV disabling 

Requirement: Service n°l "allocated and activated". 

The ME checks the CHVl status. If the CHVl status is "blocked", the procedure ends and is finished unsuccessfully. 
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If the CHVl status is not "blocked", the ME reads the CHVl enabled/disabled indicator. If this is set "disabled", the 
procedure ends and is finished unsuccessfully. 

If the CHVl status is not "blocked" and the enabled/disabled indicator is set "enabled", the ME uses the DISABLE 
CHV function. If the CHVl presented by the ME is equal to the CHVl stored in the SIM, the status of CHVl is set 
"disabled" and the procedure is finished successfully. If the CHVl presented by the ME is not equal to the CHVl stored 
in the SIM, the procedure ends and is finished unsuccessfully. 

11.3.4 CHV enabling 

The ME checks the CHVl status. If the CHVl status is "blocked", the procedure ends and is finished unsuccessfully. 

If the CHVl status is not "blocked", the ME reads the CHVl enabled/disabled indicator. If this is set "enabled", the 
procedure ends and is finished unsuccessfully. 

If the CHVl status is not "blocked" and the enabled/disabled indicator is set "disabled", the ME uses the ENABLE 
CHV function. If the CHVl presented by the ME is equal to the CHVl stored in the SIM, the status of CHVl is set 
"enabled" and the procedure is finished successfully. If the CHV presented by the ME is not equal to the CHVl stored 
in the SIM, the procedure ends and is finished unsuccessfully. 

11.3.5 CHV unblocking 

The execution of the CHV unblocking procedure is independent of the corresponding CHV status, i.e. being blocked or 
not. 

The ME checks the UNBLOCK CHV status. If the UNBLOCK CHV status is "blocked", the procedure ends and is 
finished unsuccessfully. 

If the UNBLOCK CHV status is not "blocked", the ME uses the UNBLOCK CHV function. If the UNBLOCK CHV 
presented by the ME is equal to the corresponding UNBLOCK CHV stored in the SIM, the relevant CHV status 
becomes "unblocked" and the procedure is finished successfully. If the UNBLOCK CHV presented by the ME is not 
equal to the corresponding UNBLOCK CHV stored in the SIM, the procedure ends and is finished unsuccessfully. 

1 1 .4 GSM security related procedures 

11.4.1 GSM algorithms computation 

The ME selects DFgsm and uses the RUN GSM ALGORITHM function (see clause 8.16). The response SRES-Kc is 
sent to the ME when requested by a subsequent GET RESPONSE command. 

11.4.2 IMSI request 

The ME performs the reading procedure with EFimsi- 

1 1 .4.3 Access control request 

The ME performs the reading procedure with EFacc- 

1 1 .4.4 HPLMN search period request 

The ME performs the reading procedure with EFhplmn- 

1 1 .4.5 Location information 

Request: The ME performs the reading procedure with EFloci- 

Update: The ME performs the updating procedure with EFloci- 
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11.4.6 Cipher key 

Request: The ME performs the reading procedure with EFkc- 

Update: The ME performs the updating procedure with EFkc- 

11.4.7 BCCH information 

Request: The ME performs the reading procedure with EFbcch- 

Update: The ME performs the updating procedure with EFbcch- 

11.4.8 Forbidden PLMN 

Request: The ME performs the reading procedure with EFplmn- 
Update: The ME performs the updating procedure with EFplmn- 

1 1 .4.9 LSA information 

Request: The ME performs the reading procedure with EFsai, EFsll and its associated LSA Descriptor files. 
Update: The ME performs the updating procedure with EFsll- 

1 1 .4.1 GPRS Location information 

Requirement: Service n°38 "allocated and activated". 

Request: The ME performs the reading procedure with EFlocigprs- 
Update: The ME performs the updating procedure with EFlocigprs- 

11.4.11 GPRS Cipher l<ey 

Requirement: Service n°38 "allocated and activated". 

Request: The ME performs the reading procedure with EFkcgprs- 
Update: The ME performs the updating procedure with EFkcgprs- 

1 1 .5 Subscription related procedures 
1 1.5.1 Dialling numbers 

The following procedures may not only be applied to EFadn and its associated extension files EFccp and EFexti as 
described in the procedures below, but also to EFfdn, EFmsisdn, EFlnd, EFbdn, EFsdn, EFmbdn and their associated 
extension files. If these files are not allocated and activated, as denoted in the SIM service table, the current procedure 
shall be aborted and the appropriate EFs shall remain unchanged. 

As an example, the following procedures are described as applied to ADN. 

Requirement: Service n°2 "allocated and activated" 

(Service n°3 for FDN, 

Service n°9 for MSISDN, 

Service n°13 for END, 

Service n° 18 for SDN, 
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Service n°31 for BDN, 

Service n°53 for MBDN) 

Update: The ME analyses and assembles the information to be stored as follows (the byte identifiers used 

below correspond to those in the description of the EFs in clauses 10.5.1, 10.5.4 and 10.5.10): 

i) The ME identifies the Alpha-tagging, Capability/Configuration Identifier and Extensionl Record Identifier. 

ii) The dialling number/SSC string shall be analysed and allocated to the bytes of the EF as follows: 

if a "+" is found, the TON identifier is set to "International"; 

if 20 or less "digits" remain, they shall form the dialling number/SSC string; 

if more than 20 "digits" remain, the procedure shall be as follows: 

Requirement: 

Service n°10 "allocated and activated"; 

(Service n°10 applies also for MSISDN and LND; 

Service n° 11 for FDN; 

Service n°19 for SDN; 

Service n°32 for BDN; 

Service n°53 for MBDN). 

The ME seeks for a free record in EFgj^jj. If an Extensionl record is not marked as "free", the ME runs the 
Purge procedure. If an Extensionl record is still unavailable, the procedure is aborted. 

The first 20 "digits" are stored in the dialling number/SSC string. The value of the length of BCD 
number/SSC contents is set to the maximum value, which is 1 1. The Extensionl record identifier is coded 
with the associated record number in the EFexti- The remaining digits are stored in the selected Extensionl 
record where the type of the record is set to "additional data". The first byte of the Extensionl record is set 
with the number of bytes of the remaining additional data. The number of bytes containing digit information 
is the sum of the length of BCD number/SSC contents of EFadn and byte 2 of all associated chained 
Extensionl records containing additional data (see clauses 10.5.1 and 10.5.10). 

iii) If a called party subaddress is associated to the ADN/SSC the procedure shall proceed as follows: 

Requirement: 

Service n°10 "allocated and activated" 

(Service n°10 applies also for MSISDN and LND; 

Service n° 11 for FDN; 

Service n°19 for SDN; 

Service n°32 for BDN; 

Service n°53 for MBDN). 

If the length of the called party subaddress is less than or equal to 1 1 bytes (see TS 04.08 [15] for coding): 

the ME seeks for a free record in EFgj^jj. If an Extensionl record is not marked as "free", the ME runs 
the Purge procedure. If an Extensionl record is still unavailable, the procedure is aborted; 

the ME stores the called party subaddress in the Extensionl record, and sets the Extensionl record type to 
"called party subaddress". 

If the length of the called party subaddress is greater than 1 1 bytes (see TS 04.08 [15] for coding): 

the ME seeks for two free records in EEgj^j^ If no such two records are found, the ME runs the Purge 
procedure. If two Extensionl records are still unavailable, the procedure is aborted; 
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the ME stores the called party subaddress in the two Extensionl records. The identifier field in the 
Extensionl record containing the first part of the subaddress data is coded with the associated EFexti 
record number containing the second part of the subaddress data. Both Extensionl record types are set to 
"called party subaddress". 

Once i), ii), and iii) have been considered the ME performs the updating procedure with EFadn- If the SIM has no 
available empty space to store the received ADN/SSC, or if the procedure has been aborted, the ME advises the user. 

NOTE 1 : For reasons of memory efficiency the ME is allowed to analyse all Extensionl records to recognize if the 
additional or subaddress data to be stored is already existing in EFexti- In this case the ME may use the 
existing chain or the last part of the existing chain from more than one ADN (LND, MSISDN). The ME is 
only allowed to store extension data in unused records. If existing records are used for multiple access, 
the ME shall not change any data in those records to prevent corruption of existing chains. 

Erasure: The ME sends the identification of the information to be erased. The content of the identified 

record in EFadn is marked as "free". 

Request: The ME sends the identification of the information to be read. The ME shall analyse the data of 

EFadn (subclause 10.5.1) to ascertain, whether additional data is associated in EFexti or EFccp- If 
necessary, then the ME performs the reading procedure on these EFs to assemble the complete 
ADN/SSC. 

Purge: The ME shall access each EF which references EFexti (EFext2, EFexts) for storage and shall 

identify records in these files using extension data (additional data or called party subaddress). 
Note that existing chains have to be followed to the end. All referred Extensionl (Extension2, 
Extension6) records are noted by the ME. All Extensionl (Extension2, Extension6) records not 
noted are then marked by the ME as "free" by setting the whole record to 'FF'. 

NOTE 2: Dependent upon the implementation of the ME, and in particular the possibility of erasure of ADN/SSC 
records by Phase 1 MEs, which have no knowledge of the EFexti it is possible for Extensionl records to 
be marked as "used space" (not equal to 'FF'), although in fact they are no longer associated with an 
ADN/SSC record. 

The following three procedures are only applicable to service n°3 (FDN). 

FDN capability request. The ME has to check the state of service n°3, i.e. if FDN is "enabled" or "disabled". In case of 
enabled FDN, the ME has to switch to a restrictive terminal mode (see TS 02.07). To ascertain the state of FDN, the 
ME checks in EF§gj whether or not ADN is activated. If ADN is not activated, service n°3 is enabled. If ADN is 

activated, the ME checks the response data of EFadn- If EFadn is invalidated, service n°3 is enabled. In all other cases 
service n°3 is disabled. 

FDN disabling. The FDN disabling procedure requires that CHV2 verification procedure has been performed 
successfully and that ADN is activated. If not, FDN disabling procedure will not be executed successfully. To disable 
FDN capability, the ME rehabilitates EFadn- The invalidate/rehabilitate flag of EFadn, which is implicitly set by the 
REHABILITATE command, is at the same time the indicator for the state of the service n°3- If ADN is not activated, 
disabling of FDN is not possible and thus service n°3 is always enabled (see FDN capability request). 

NOTE 3: If FDN is disabled (by rehabilitating EFadn) using an administrative terminal then the FDN disabling 
procedure of this administrative terminal need also to rehabilitate EFimsi and EFloci to ensure normal 
operation of the SIM in a phase 1 ME or a phase 2 ME which does not support FDN. 

FDN enabling. The FDN enabling procedure requires that CHV2 verification procedure has been performed 
successfully. If not, FDN enabling procedure will not be executed successfully. To enable FDN capability, the ME 
invalidates EFadn- The invalidate/rehabilitate flag of EFadn, which is implicitly cleared by the INVALIDATE 
command, is at the same time the indicator for the state of the service n°3 (see FDN capability request). If ADN is not 
activated, service n°3 is always enabled. 

Invalidated ADNs may optionally still be readable and updatable depending on the file status (see clause 9.3) 

The following three procedures are only applicable to service n°31 (BDN). 

BDN capability request. The ME has to check the state of service n°31, i.e. if BDN is "enabled" or "disabled". BDN 
service is "enabled" only if service n°31 is allocated and activated, and EFbdn is not invalidated. In all other cases, the 
BDN service is "disabled". 
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BDN disabling. The BDN disabling procedure requires that CHV2 verification procedure has been performed 
successfully. If not, BDN disabling procedure will not be executed successfully. To disable BDN capability, the ME 
invalidates EFbdn- The invalidate/rehabilitate flag of EFbdn^ which is implicitly cleared by the INVALIDATE 
command, is at the same time the indicator for the state of the service n°31 (see BDN capability request). 

BDN enabling. The BDN enabling procedure requires that CHV2 verification procedure has been performed 
successfully. If not, BDN enabling procedure will not be executed successfully. To enable BDN capability, the ME 
rehabilitates EFbdn- The invalidate/rehabilitate flag of EFbdn^ which is implicitly set by the REHABILITATE 
command, is at the same time the indicator for the state of the service n°31 (see BDN capability request). 

Invalidated BDNs (when BDN capability is disabled) may optionally still be readable and updatable depending on the 
file status (see clause 9.3). 

1 1 .5.2 Short messages 

Requirement: Service n°4 "allocated and activated". 

Request: The SIM seeks for the identified short message. If this message is found, the ME performs the 

reading procedure with EFsms- 

If service n°35 is "allocated and activated" and the status of the SMS is 'ID' (status report 
requested, received and stored in EFsmsr)^ the ME performs the reading procedure with the 
corresponding record in EFsmsr- If the ME does not find a corresponding record in EFsmsr^ then 
the ME shall update the status of the SMS with '19' (status report requested, received but not 
stored in EFsmsr)- 

If the short message is not found within the SIM memory, the SIM indicates that to the ME. 

Update: The ME looks for the next available area to store the short message. If such an area is available, it 

performs the updating procedure with EFsms- 

If there is no available empty space in the SIM to store the received short message, a specific MMI 
will have to take place in order not to loose the message. 

Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message 

may be read before the area is marked as "free". After performing the updating procedure with 
EFgjyfg, the memory allocated to this short message in the SIM is made available for a new 
incoming message. The memory of the SIM may still contain the old message until a new message 
is stored in this area. 

If service n°35 is "allocated and activated" and the status of the SMS is 'ID' (status report 
requested, received and stored in EFsmsr)^ the ME performs the erasure procedure for EFsmsr with 
the corresponding record in EFsmsr- 

1 1 .5.3 Advice of Charge (AoC) 

Requirement: Service n°5 "allocated and activated". 

Accumulated Call Meter. 

Request: The ME performs the reading procedure with EFacm- The SIM returns the last updated value of the 

ACM. 

Initialization: The ME performs the updating procedure with EF^cm using the new initial value. 

Increasing: The ME performs the increasing procedure with EFacm sending the value which has to be added. 

Accumulated Call Meter Maximum Value. 

Request: The ME performs the reading procedure with EFACMmax- 

Initialization: The ME performs the updating procedure with EFACMmax using the new initial maximum value. 
Price per Unit and Currency Table (PUCT). 
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Request: The ME performs the reading procedure with EFpucx- 

Update: The ME performs the updating procedure with EFpucx- 

1 1 .5.4 Capability configuration parameters 

Requirement: Service n°6 "allocated and activated". 

Request: The ME performs the reading procedure with EFccp- 

Update: The ME performs the updating procedure with EFccp- 

Erasure: The ME sends the identification of the requested information to be erased. The content of the 

identified record in EFccp is marked as "free". 

11.5.5 PLMN selector 

Requirement: Service n°7 "allocated and activated". 

Request: The ME performs the reading procedure with EFplmnsci- 

Update: The ME performs the updating procedure with EFplmnsci- 

1 1 .5.6 Cell broadcast message identifier 

Requirement: Service n°14 "allocated and activated". 

Request: The ME performs the reading procedure with EFcbmi- 

Update: The ME performs the updating procedure with EFcbmi- 

1 1 .5.7 Group identifier level 1 

Requirement: Service n°15 "allocated and activated". 

Request: The ME performs the reading procedure with EFqidi. 

1 1 .5.8 Group identifier level 2 

Requirement: Service n°16 "allocated and activated". 
Request: The ME performs the reading procedure with EFgid2. 

1 1 .5.9 Service Provider Name 

Requirement: Service n°17 "allocated and activated". 

Request: The ME performs the reading procedure with EFspn- 

11.5.10 Voice Group Call Services 

Requirement: Service n°18 "allocated and activated". 
Voice Group Call Service 

Request: The ME performs the reading procedure with EFvgcs- 

Voice Group Call Service Status 

Request: The ME performs the reading procedure with EFvgcss- 

Update: The ME performs the updating procedure with EFvgcss- 
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11.5.11 Voice Broadcast Services 

Requirement: Service n°19 "allocated and activated". 
Voice Broadcast Service 

Request: The ME performs the reading procedure with EFvbs- 

Voice Broadcast Service Status 

Request: The ME performs the reading procedure with EFvbss- 

Update: The ME performs the updating procedure with EFvbss- 

1 1.5.12 Enlnanced Multi Level Pre-emption and Priority Service 

Requirement: Service n°18 "allocated and activated". 
Enhanced Multi Level Pre-emption and Priority 

Request: The ME performs the reading procedure with EFeMLPP- 

Automatic Answer on eMLPP service 

Request: The ME performs the reading procedure with EFaabm- 

Update: The ME performs the updating procedure with EFaabm- 

1 1 .5.13 Cell Broadcast Message range identifier 

Requirement: Service n°30 "allocated and activated". 

Request: The ME performs the reading procedure with EFcbmir- 

Update: The ME performs the updating procedure with EFcbmir- 

1 1 .5.1 4 Depersonalisation Control Keys 

Requirement: Service n°33 "allocated and activated". 

Request: The ME performs the reading procedure with EFqck- 

1 1 .5.1 5 Short message status report 

Requirement: Service n°35 "allocated and activated". 

Request: If the status of a stored short message indicates that there is a corresponding status report, the ME 

performs the seek function with EFsmsr to identify the record containing the appropriate status 
report. The ME performs the reading procedure with EFsmsr- 

Update: If a status report is received, the ME first seeks within the SMS record identifiers of EFsmsr for 

the same record number it used for the short message in EFsms- If such a record identifier is found 
in EFsmsr, it is used for storage. If such a record identifier is not found, then the ME seeks for a 
free entry in EFsmsr for storage. If no free entry is found the ME runs the Purge procedure with 
EFsmsr- If there is still no free entry, the status report is not stored. 

If the ME found an appropriate record in EFsmsr for storage, it updates the record with the status 
report setting the record identifier in EFsmsr to the appropriate record number of the short message 
in EFsms- 

The status in EFsms is updated accordingly (see clause 10.5.3) by performing the update procedure 
with EFsMs- 
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Erasure: The ME runs the update procedure with EFsmsr by at least storing '00' in the first byte of the 

record. The ME may optionally update the following bytes with 'FF'. 

Purge: The ME shall read the SMS record identifier (byte 1) of each record of EFsmsr- With each record 

the ME checks the corresponding short messages in EFsms- If the status (byte 1) of the 
corresponding SMS is not equal 'ID' (status report requested, received and stored in EFsmsr), the 
ME shall perform the erasure procedure with the appropriate record in EFsmsr- 

11.5.16 Network's indication of alerting 

Requirement: Service n°36 "allocated and activated". 

Request: The ME performs the reading procedure with EFnia- 

1 1 .5.1 7 User controlled PLMN Selector with Access Technology 

Requirement: Service n°43" allocated and activated". 

Request: The ME performs the reading procedure with EFplmnwAct- 

Update: The ME performs the updating procedure with EFplmnwAct- 

11.5.18 Operator controlled PLMN Selector with Access Technology 

Requirement: Service n°44 "allocated and activated". 

Request: The ME performs the reading procedure with EFoplmnwAct 

1 1 .5.1 9 HPLMN Selector with Access Technology 

Requirement: Service n°45 "allocated and activated". 

Request: The ME performs the reading procedure with EFhplmnact- 

11.5.20 CPBCCH information 

Requirement: Service n°46 "allocated and activated". 

Request: The ME performs the reading procedure with EFcpbcch- 

Update: The ME performs the updating procedure with EFcpbcch- 

1 1 .5.21 Investigation Scan 

Requirement: Service n°47 "allocated and activated". 

Request: The ME performs the reading procedure with EFinvScan- 

1 1 .5.22 RPLMN last used Access Technology 

Requirement: Service n°50 "allocated and activated". 

Request: The ME performs the reading procedure with EFrplmnact- 

Update: The ME performs the updating procedure with EFrplmnact- 

1 1 .5.23 PLMN Network Name 

Requirement: Service n°51 " allocated and activated ". 
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Request: The ME performs the reading procedure with EFpnn. 

1 1 .5.24 Operator PLMN List 

Requirement: Service n°52 " allocated and activated ". 

Request: The ME performs the reading procedure with EFopl 

1 1 .5.25 Message Waiting Indication 

Requirement: Service n°54 " allocated and activated ". 

Request: The ME performs the reading procedure with EFmwis- 

Update: The ME performs the updating procedure with EFmwis- 

1 1 .5.26 Call Forwarding Indication Status 

Requirement: Service n°55 " allocated and activated ". 

Request: The ME performs the reading procedure with EFcpis- 

Update: The ME performs the updating procedure with EFcpis- 

1 1 .5.27 Service Provider Display Information 

Requirement: Services n°17 and 56 are "allocated and activated". 
Request: The ME performs the reading procedure with EFspdi- 

Update: The ME performs the updating procedure with EFspdi- 

1 1 .6 SIM Application Toolkit related procedures 

SIM Application Toolkit is an optional feature. The higher level procedures, and contents and coding of the commands, 
are given in TS 11.14 [27]. Procedures relating to the transmission of commands and responses across the SIM/ME 
interface are given in this clause. A SIM or ME supporting SIM Application Toolkit shall conform to the requirements 
given in this clause. 

11 .6.1 Initialization procedure 

A SIM supporting SIM Application Toolkit shall indicate this through relevant data in EFphase and EFsst. as defined in 
the relevant clauses above. 

An ME supporting SIM Application Toolkit shall perform initialization as defined in the SIM Initialization clause 
above. 



11.6.2 Proactive polling 



An ME supporting proactive SIM (part of SIM Application Toolkit) shall support the polling procedure as defined 
above. 



1 1 .6.3 Support of commands 



A SIM or ME supporting SIM Application Toolkit shall support the commands TERMINAL PROFILE, ENVELOPE, 
FETCH and TERMINAL RESPONSE. 

These commands shall never be used if either the SIM or ME does not support SIM Application Toolkit. Therefore 
standard SIMs and MEs do not need to support these commands. 
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1 1 .6.4 Support of response codes 



A SIM or ME supporting SIM Application Toolkit shall support the response status words (SWl SW2) '91 XX', and 
'93 00' and '9E XX'. The SIM shall send '9E XX' only to an ME indicating in TERMINAL PROFILE that it supports the 
handling of these status words. 

These responses shall never be used if either the SIM or ME does not support SIM Application Toolkit. Therefore 
standard SIMs and MEs do not need to support them. 

1 1 .6.5 Command-response pairs 

Using the terminology where the ME issues a command and the SIM a response, ending in status words SWl SW2, a 
command-response pair is considered as a single transaction. Each transaction is initiated by the ME and terminated by 
the SIM. One transaction must be completed before the next one can be initiated. This protocol applies to SIM 
Application Toolkit in the same way as it does to normal operation. 

1 1 .6.6 Independence of normal GSM and SIM Application Toolkit tasks 

Normal GSM operation (relating to general, CHV related, GSM security related, and subscription related procedures) 
and SIM Application Toolkit operation shall be logically independent, both in the SIM and in the ME. 

Specifically, this means: 

the currently selected EF and current record pointer in the normal GSM task shall remain unchanged, if still 
valid, as seen by the ME, irrespective of any SIM Application Toolkit activity; 

between successive SIM Application Toolkit related command-response pairs, other normal GSM related 
command-response pairs can occur. The SIM Application Toolkit task status shall remain unchanged by these 
command-response pairs. 

1 1 .6.7 Use of BUSY status response 

If for any reason the SIM Application Toolkit task of the SIM cannot process an ENVELOPE command issued by the 
ME at present (e.g. other SIM Application Toolkit processes are already running, and this additional one would cause 
an overload), the SIM can respond with a status response of '93 00'. The ME may re-issue the command at a later stage. 

The BUSY status response has no impact on normal GSM operation. 



11 .6.8 Use of NULL procedure byte 



The NULL procedure byte provides a mechanism for the SIM to obtain more time before supplying the response part of 
a command-response pair, during which time the ME is unable to send further commands to the SIM. 

If a SIM Application Toolkit activity in the SIM runs for too long, this may prevent the ME from sending "normal 
GSM" commands which are time-critical, e.g. RUN GSM ALGORITHM. A MORE TIME command is defined in 
TS 11.14 [27], which ensures that the SIM Application Toolkit task in the SIM gets more processing time, while at the 
same time freeing the SIM/ME interface. This should be used in preference to NULL procedure bytes ('60'). 

1 1 .6.9 Using the TERMINAL PROFILE, ENVELOPE, and TERMINAL 
RESPONSE commands 

These commands are part of the set used by SIM Application Toolkit. The use of the these commands, the occasions 
where they are required, and the command and response parameters associated with the commands, are specified in 
TS 11.14 [27]. The ME completes the command parameters/data of the relevant command and sends the command to 
the SIM. The transmitted data is processed by the SIM in a specific way depending on the tag value in the command 
parameters. 

A SIM or ME not supporting SIM Application Toolkit does not need to support these commands. 
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11.6.10 Using the FETCH command 



This command is used by SIM Application Toolkit. The use of the this command, the occasions where it is required, 
and the command and response parameters associated with the command, are specified in TS 11. 14 [27]. It is similar in 
function to GET RESPONSE, in that it requests response parameters from the SIM, following a '91 XX' status response. 
The transmitted response data from the SIM is processed by the ME in a specific way depending on the tag value in the 
response parameters. 

A SIM or ME not supporting SIM Application Toolkit does not need to support this command. 

11.6.11 Data Download via SMS-CB 

Requirement: Service n°25 "allocated and activated". 

The ME shall perform the reading procedure with EFQg]y£jj-). On receiving a cell broadcast message with an identifier 
which matches an identifier in EFcbmid^ the ME shall pass the CB message to the SIM using the ENVELOPE 
command. If a match is not found and service no. 14 is "allocated and activated", then the message identifier is checked 
against those in EFcbmi- 

11.6.12 Data Download via SMS-PP 

Requirement: Service n°26 "allocated and activated". 
The procedures and commands for Data Download via SMS-PP are defined in TS 1 1.14 [27]. 

11.6.13 Menu selection 

Requirement: Service n°27 "allocated and activated". 
The procedures and commands for Menu Selection are defined in TS 1 1. 14 [27]. 

11.6.14 Call Control 

Requirement: Service n°28 "allocated and activated". 

The procedures and commands for Call Control are defined in TS 11. 14 [27]. It is mandatory for the ME to perform the 
procedures if it has indicated that it supports Call Control in the TERMINAL PROFILE command. When BDN is 
enabled, the Call control facility of the ME is used by the SIM to support the BDN service. 

11.6.15 Proactive SIM 

Requirement: Service n°29 "allocated and activated". 
The procedures and commands for Proactive SIM, at the application level, are defined in TS 11.14 [27]. 

1 1 .6.1 6 Mobile Originated Short Message control by SIM 

Requirement: Service n°37 "allocated and activated". 

The procedures and commands for Mobile Originated Short Message control by SIM are defined in TS 11.14 [27]. It is 
mandatory for the ME to perform the procedures if it has indicated that it supports Mobile Originated Short Message 
control by SIM in the TERMINAL PROFILE command. 

11.6.17 SIM data download error 

In case of an ENVELOPE for SIM data download, the SIM can respond with the status words '9E XX' to indicate that 
response data is available. The ME shall use the GET RESPONSE command to get the response data. The ME shall 
then send transparently to the network this response data, using the error procedure of the transport mechanism. 
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11.6.18 Image Request 

Requirement: Service n°39 "allocated and activated". 

The ME sends the identification of the information to be read. The ME shall analyse the data of EFimg (clause 10.6.1.1) 
to identify the files containing the image's instances. If necessary, then the ME performs READ BINARY commands 
on these files to assemble the complete image instance data. 



1 1 .7 MExE related procedures 



MExE is an optional feature. The higher level procedures, and contents and coding of the commands, are given in 
TS 23.057 [50]. Procedures relating to the transmission of commands and responses across the SIM/ME interface are 
given in this clause. A SIM or ME supporting MExE shall conform to the requirements given in this clause. 

11.7.1 MExE ST 

Requirement: Service n°49 (MExE) "allocated and activated". 

Request: The ME performs the reading procedure with EFmexe_st. 

1 1 .7.2 Operator root public key 

Requirement: Service n°49 (MExE) "allocated and activated" and MExE ST service n°l (EForpk)" allocated and 

activated". 
Request: The ME performs the reading procedure with EFqrpk The ME shall analyse the data of EFqrpk 

(clause 10.7.2) to identify the files containing the certificate instances. If necessary, then the ME 

performs READ BINARY commands on these files to assemble the complete certificate instance 

data. 



1 1 .7.3 Administrator root public key 

Requirement: 
Request: 



Service n°49 (MExE) "allocated and activated" and MExE ST service n°2 (EFarpk) "allocated and 

activated". 

The ME performs the reading procedure with EFarpk. The ME shall analyse the data of EFarpk 

(clause 10.7.3) to identify the file containing the certificate instance. If necessary, then the ME 

performs READ BINARY commands on this file to assemble the complete certificate instance 

data. 



1 1 .7.4 Third Party root public key(s) 

Requirement: 
Request: 



Service n°49 (MExE) "allocated and activated" and MExE ST service n°3 (EFtprpk) "allocated and 

activated". 

The ME performs the reading procedure with EFxprpk. The ME shall analyse the data of EFtprpk 

(clause 10.7.4) to identify the files containing the certificate instances. If necessary, then the ME 

performs READ BINARY commands on these files to assemble the complete certificate instance 

data. 
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Annex A (normative): 
Void 
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Annex B (normative): 
Void 
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Annex C (informative): 
FDN/BDN Procedures 




Phase 2+ 



Perform Profile 
Download 



(see noteS) 



not invalidated 
(see note 2) 



invalidated 



6 



ME: unrestricted 
operation 

NOTE 1 : In case of enabled FDN and/or enabled BDN, tfie EF has been Invalidated by the SIM at no later than this 

stage. 
NOTE 2: Invalidation of only one of the two EFs is not allowed for FDN and BDN. 
NOTE 3: For SIMs with enabled BDN this procedure is used to check whether the ME supports the Call Control by 

the SIM facility. 

Figure C.I a: Example of an Initialization Procedure of a FDN/BDN SIM (see clause 11.2.1) 
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1. 



SIM capability 
request 




yes 



Relnabilitate 



(note 4) 




no 



(note 5) 



r 



yes 



yes 



Relnabilitate 



(note 4) 



no 




^,,relnabilitate> 
(note 5) \^ ^ 



yes 



restricted or unrestricted no operation FDN operation 
operation, according to 
the state (enabled/disabled) 
of the various services 
(FDN, CC) 

NOTE 4: In case of "BDN enabled", the SIIVI only allows rehabilitation of the EFimsi and EFlqci, if the ME has 
indicated its CC-capability to the SIM (by PROFILE_DOWNLOAD). 

NOTE 5: Possibility for future "restricting" services to use the internal SIM mechanism of invalidation of EFimsi and 
EFlqci. 

NOTE 6: If the ME does not support all enabled services (e.g. FDN, BDN), it does not operate. In case of enabled 
BDN, the support of the "Call Control Feature" by the ME is sufficient for operation. For future use, there 
may be additional "restricting" services, which are not known to the ME. In that case the ME will perform 
the subsequent rehabilitation procedure but will fail to rehabilitate EFimsi and EFlqci (see note 4). 

Figure C.lb: Example of an Initialization Procedure of a FDN/BDN SIM (continued) 
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BDN capability 
request 



FDN capability 
request 



Figure C.2: SIM capability request 



no 



Select EF sst 



Read EFsst 



yes 



Select DF telecom 



Select EF bdn 



Get Response 

(evaluation of 

invalidation flag) 



BDN enabled 





no 



BDN disabled 



No BDN SIIVI 



Figure C.3: BDN capability request (see clause 11.5.1) 
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Select EF 



SST 



Read EF 



SST 



no 




(see note 7) 



yes 



Get Response 
(evaluation of 
invalidation flag) 




FDN enabled 



FDN disabled No FDN SIM 



NOTE 7: In this case FDN is enabled without the possibility of disabling. 

Figure C.4: FDN capability request (see clause 11.5.1) 
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C Rehabilitate r\ 



Select EFf._, 

IMSI 



Reliabilitate 



EF 



IMSI 



Select EF 



LOCI 



Rehabilitate 

^'^ LOCI 



J 



(Note 8) 



(Note 8) 



NOTE 8: If BDN is enabled in the SIM, and if the Profile download procedure has not indicated that the ME supports 
Call Control, the EF is not rehabilitated by the SIM. 

Figure C.5: Procedure to rehabilitate GSM files 




Boolean Equation: 

FD = FDA.(NOT(ADA)+ADA.ADI) 

where 
FD = FDN enabled 
FDA = FDN allocated and activated 
ADA = ADN allocated and activated 
AD! = EFadn invalidated 



FDN enabled 



FDN not enabled 
Figure C.6: Coding for state of FDN 



£75/ 



3GPP TS 51.011 version 4.4.0 Release 4 1 26 ETSI TS 151011 V4.4.0 (2002-06) 

Annex D (informative): 

Suggested contents of the EFs at pre-personalization 

If EFs have an unassigned value, it may not be clear from the main text what this value should be. This annex suggests 
values in these cases. 
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File Identification 


Description 


Value 


'2FE2' 


ICC identification 


operator dependant (see 1 0.1 .1 ) 


'2F05' 


Extended Language preference 


'FF...FF' 


'6F05' 


Language preference 


'FF' 


'6F07' 


IMSI 


operator dependant (see 10.3.2) 


'6F20' 


Ciphering l<ey Kc 


'FF...FF07' 


'6F30' 


PLIVIN selector 


'FF...FF' 


'6F31' 


HPLMN search period 


'FF' 


'6F37' 


ACM maximum value 


'000000' (see note 1 ) 


'6F38' 


SIM service table 


operator dependant (see 10.3.7) 


'6F39' 


Accumulated call meter 


'000000' 


'6F3E' 


Group identifier level 1 


operator dependant 


'6F3F' 


Group identifier level 2 


operator dependant 


'6F41' 


PUCT 


'FFFFFFOOOO' 


'6F45' 


CBMI 


'FF...FF' 


'6F46' 


Service provider name 


'FF...FF' 


'6F48' 


CBMID 


'FF...FF' 


'6F49' 


Service Dialling Numbers 


'FF...FF' 


'6F74' 


BCCH information 


'FF...FF' 


'6F78' 


Access control class 


operator dependant (see 1 0.3.1 5) 


'6F7B' 


Forbidden PLMNs 


'FF...FF' 


'6F7E 


Location information 


'FFFFFFFF xxxxxx 0000 FF 01' 
(see note 2) 


'6FAD' 


Administrative data 


operator dependant (see 10.3.18) 


'6FAE' 


Phase identification 


see 10.3.16 


'6F3A' 


Abbreviated dialling numbers 


'FF...FF' 


'6F3B' 


Fixed dialling numbers 


'FF...FF' 


'6F3C' 


Short messages 


'OOFF...FF' 


'6F3D' 


Capability configuration parameters 


'FF...FF' 


'6F40' 


MSISDN storage 


'FF...FF' 


'6F42' 


SMS parameters 


'FF...FF' 


'6F43' 


SMS status 


'FF...FF' 


'6F44' 


Last number dialled 


'FF...FF' 


'6F47' 


Short message status reports 


'OOFF...FF' 


'6F4A' 


Extension 1 


'FF...FF' 


'6F4B' 


Extension 2 


'FF...FF' 


'6F4C' 


Extension 3 


'FF...FF' 


'6F4D' 


Barred dialling numbers 


'FF...FF' 


'6F4E' 


Extension 4 


'FF...FF' 


'6F4F' 


Extended capability configuration parameters 


'FF...FF' 


'6F51' 


Network's indication of alerting 


'FF...FF' 


'6F52' 


GPRS Ciphering key KcGPRS 


'FF...FF07' 


'6F53' 


GPRS Location Information 


'FFFFFFFF FFFFFF xxxxxx 0000 FF 01 ' 
(see note 2) 


'6F54' 


SetUpMenu Elements 


operator dependant (see 10.3.34) 


'6F58' 


Comparison method information 


'FF...FF' 


'6F60' 


User controlled PLMN Selector with Access 
Technology 


'FFFFFFOOOO.. FFFFFFOOOO' 


'6F61' 


Operator controlled PLMN Selector with 
Access Technology 


'FFFFFFOOOO.. FFFFFFOOOO' 


'6F62' 


HPLMN Selector with Access Technology 


'FFFFFFOOOO.. FFFFFFOOOO' 


'6F63' 


CPBCCH information 


'FF..FF' 


'6F64' 


Investigation Scan 


'00' 


'6F65' 


RPLMN last used Access Technology 


'0000' 




Continued 
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File Identification 


Description 


Value 


'4F20' 


Image data 


'OOFF...FF' 


'4F30' 


SoLSA Access Indicator) 


'OOFF...FF' 


'4F31' 


SoLSA LSA List 


'FF...FF' 


'6FC5' 


PLIVIN Network Name 


Operator dependant 


'6FC6' 


Operator PLMN List 


Operator dependant 


'6FC7' 


IVIailbox Dialling Numbers 


Operator dependant 


'6FC8' 


Extension 6 


'00 FF...FF' 


'6FC9' 


IVIailbox Identifier 


Operator dependant 


'6FCA' 


Message Waiting Indication Status 


'00 00 00 00 00' 


'6FCB' 


Call Forwarding Indication Status 


'XX00FF...FF' 


'6FCC' 


Extension 7 


'00 FF...FF' 


'6FCD' 


Service Provider display Information 


'FF...FF' 



NOTE 1: The value '000000' means that ACMmax is not valid, i.e. there is no restriction on the ACM. When 

assigning a value to ACMmax, care should be taken not to use values too close to the maximum possible 
value 'FFFFFF', because the INCREASE command does not update EF^^qj^ if the units to be added would 
exceed 'FFFFFF'. This could affect the call termination procedure of the Advice of Charge function. 

NOTE 2: xxxxxx stands for any valid MCC and MNC, coded according to TS 04.08 [15]. 
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Annex E (informative): 

SIIVI application Toolkit protocol diagrams 

The diagrams in this annex are intended to illustrate the data protocols of the SIM toolkit application in various 
situations. The SIM application is shown as initiated by SMS Data Download messages. Other possibilities exist (as 
defined in TS 11. 14) such as data entry from a menu selection. 



Case 1: Simple 



Network 



ME 



GSM 
SIM 



SIM 
Application 



SMSsiM 

_Data_Download/Class_2 


ENV(SMS) 






'9000' 


SMS Ack 







(SMS) 



('9000') 



This shows the simple case where an SMS for SIM updating is received from the network, passed to the SIM by the ME 
and processed immediately by the SIM application. This requires no ME action except to acknowledge the SMS. 
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Case 2: Simple with short delay 



Network 



ME 



GSM 
SIM 



SIM 
AppI 



SMSs 



_Uata_Uownload/Glass_2 



SMS Ack 



ENV(SMS) 



'60' 



'60' 



'9000' 



(SMS) 



('60') 



('60') 



('9000') 



This shows the simple case where an SMS for SIM updating is received from the network, passed to the SIM by the ME 
and which requires some time to process by the SIM application. The processing time is "not long" and is obtained by 
the SIM application sending "null procedure bytes" to the ME. Each byte has the effect of restarting the work waiting 
time so that the ME does not abort the transaction before the SIM application has finished processing the command(s) 
sent in the SMS. 

GuideUnes on timings: 

1 . The SMS Ack must be sent back before the network times out and sends the SMS again. 

2. Use of null procedure bytes must not be excessive as during this time the ME is unable to issue normal GSM 
commands to the SIM. 
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Case 3: Simple with short delay and SIM Acknowledgement 



Network 



ME 



GSM 
SIM 



SIM 
AppI 



SMSsiM 


ENV(SMS) 


(SMS) 




_Data_Download/Class_2 

SMS Ack (with 
SIM Ack) 


'60' 


('60') 




'60' 


('60') 


'9F10' 


('9F10') 


(SIM Ack) 


Get Response (16 bytes) 


SIM Ack 











This shows the same case as previously where an SMS for SIM updating is received from the network, passed to the 
SIM by the ME and which requires some time to process by the SIM application. However in this case the SIM 
application has SIM acknowledgement data to include in the SMS acknowledgement being returned to the network by 
the ME. 

Guideline on timings: 

The SMS Ack must be sent back before the network times out and sends the SMS again. 
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Case 4: A Toolkit command generated by the SIM application as a result of an SMS from the network 

Network ME 



GSM 
SIM 



SIM 
Application 



SMSs 



Data Download/Class 2 



SMS Ack 



ENV(SMS) 



'60' 



'60' 



'91 XX' 



FETCH 



Command 



TERMINAL RESPONSE 



'9000' 



(SMS) 



('60') 



('60') 



('91 XX') 



(FETCH) 



(Command) 



(TERMINAL RESPONSE) 



('9000') 



This shows the case where an SMS for SIM updating is received from the network, passed to the SIM by the ME and 
processed by the SIM application which then generates a command for action by the ME (e.g. PLAYTONE). 

NOTE: If a positive acknowledgement to the network of completion of execution of the instructions given in the 
SMS message is required then the SIM application can issue a command to the ME to send a MO SMS. 



£75/ 



3GPP TS 51.011 version 4.4.0 Release 4 



133 



ETSI TS 151 Oil V4.4.0 (2002-06) 



Case 5: A normal GSM command requires processing before the ME can respond to the 91XX from the SIM 

Network ME 



GSM 
SIM 



SIM 
Application 



SMSsiM 


- 




_Data_Download/Class_2 


ENV(SMS) 




'91 XX' 


SMS Ack 


- 






GSM Command 




'91 XX' 




- 


FETCH 




Command 




- 


TERMINAL RESPONSE 




'9000' 









(SMS) 



('91 XX') 



(FETCH) 



(Command) 



(TERMINAL RESPONSE) 



('9000') 



This shows the case where an SMS for SIM updating is received from the network, passed to the SIM by the ME and 
processed by the SIM application which then generates a command for action by the ME (e.g. PLAYTONE). However 
a normal GSM command requires processing before the ME can FETCH the command which the SIM is waiting to 
give it. The response to the normal GSM command is '91XX' in this case to remind the ME of the outstanding SIM 
application command request. 
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Case 6: MORE TIME Command 



Network 



ME 



GSM 
SIM 



SIM 
Application 



SMSs 



_Data_Download/Ciass_2 



SMS Ack 



ENV(SMS) 



'91 XX' 



^— i^ 



FETCH 



MORETIME 



TERMINAL RESPONSE 



'9000' 



(SMS) 



('91 XX') 



(FETCH) 




(MORETIME) 



(TERMINAL RESPONSE) , 



1 



('9000') 



This shows the case where an SMS for SIM updating is received from the network, passed to the SIM by the ME and 
requires a considerable period of time to be processed by the SIM application. In this case the use of null procedure 
bytes only is inappropriate as the ME must be given the opportunity to process normal GSM commands. The 
opportunities gained by the SIM application for processing, and the opportunities for normal GSM commands are 
shown in the diagram above. The sequence of 91XX, FETCH and MORETIME commands can be repeated if required. 

Opportunities to process normal GSM commands are shown thus: 



Opportunities for SIM application processing are shown thus: 
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Case 7: SIM Application Busy 



Network 



ME 



GSM 
SIM 



SIM 
Application 



SMSs 



_Data_Download/Ciass_2 



SMS NACK 




ENV(SMS') 




While the SIM application is busy processing a SMS for the SIM application arrives from the network and is sent to the 
SIM by the ME in the usual manner. The SIM operating system recognizes that the SIM application is busy, and it 
sends a busy response ('9300') to the ME. The ME then sends negative acknowledgement to the network. The 
responsibility for a retry rests with the network. 
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Annex F (informative): 

Examples of coding of LSA Descriptor files for SoLSA 

The length of all the records is determined by the LSA descriptor containing the largest number of bytes. Combinations 
containing different numbers of LSA IDs, LAC+ CI and CI or LAC can therefore be done. Various examples are show. 
Due to the OTA management of the records it is recommended that the record length is maximum 100 bytes in order to 
leave room for command descriptor and signature information in the SMS. 

This first example contains two LSAs, one described by two LSA IDs and another described by three Cell IDs, giving a 
record length of 8 bytes. 



1^' record: 



LSA descriptor 
type = LSA ID 
and number = 2 
(1 byte) 



LSA ID (3 bytes) 



LSA ID (3 bytes) 



Identifier (1 byte) 



2"*^ record: 



LSA descriptor 
type = CI and 
number = 3 
(1 byte) 


CI (2 bytes) 


CI (2 bytes) 


CI (2 bytes) 


Identifier (1 byte) 



The second example contains two LSAs, one described by one LSA ID and one described by two Cell Ids, giving a 
record length of 6 bytes. 



1^' record: 



LSA descriptor 
type = LSA ID 
and number = 1 
(1 byte) 


LSA ID (3 bytes) 


'FF' 


Identifier (1 byte) 



2"*^ record: 



LSA descriptor 
type = CI and 
number = 2 
(1 byte) 


CI (2 bytes) 


CI (2 bytes) 


Identifier (1 byte) 
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Annex G (normative): 
Image Coding Schemes 



The following image coding schemes are applicable to rectangular raster images. Raster image points are assumed to be 
of square shape. They are numbered sequentially from 1 onwards, starting at the upper left corner, proceeding line by 
line downwards, each line in turn proceeding from left to right, and ending at the image's lower right corner. 

The following example illustrates the numbering scheme for raster image points by showing how the corner points are 
numbered, assuming an image length of x points and an image height of y points. 



1 



(x*(y-i) + i) 



(x*y) 



G.1 Basic Image Coding Scheme 

This coding scheme applies to rectangular raster images made up of raster points that are either set or not set. This 
coding scheme does not support any notion of colour. Image data are coded as follows: 



Byte(s) 


Description 


Length 


1 


image width = X 


1 


2 


image lieiglit = Y 


1 


3 to K+2 


image body 


K 



Coding of image body: 

The status of each raster image point is coded in one bit, to indicate whether the point is set (status = 1) or not set 

(status = 0). 

Byte 1: 



b8 b7 b 



b5 b4 b3 b2 bl 



status of 

status of 

status of 

status of 

status of 

status of 

status of 

status of 



raster point 8 

raster point 7 

raster point 6 

raster point 5 

raster point 4 

raster point 3 

raster point 2 

raster point 1 



Byte 2: 



bS b7 b 



b5 b4 b3 b2 bl 



status of 

status of 

status of 

status of 

status of 

status of 

status of 

status of 



raster point 16 

raster point 15 

raster point 14 

raster point 13 

raster point 12 

raster point 11 

raster point 10 

raster point 9 



etc. 

Unused bits shall be set to 1 
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G.2 Colour Image Coding Scheme 

This coding scheme applies to coloured rectangular raster images. Raster image point colours are defined as references 
into a colour look-up table (CLUT), which contains a subset of the red-green-blue colour space. The CLUT in turn is 
located in the same transparent file as the image instance data themselves, at an offset defined within the image instance 
data. 

Image data are coded as follows: 



Byte(s) 


Description 


Length 


1 


Image width = X 


1 


2 


Image height = Y 


1 


3 


Bits per raster image point = B 


1 


4 


Number of CLUT entries = C 


1 


5 to 6 


Location of CLUT (Colour Look-up Table) 


2 


7 to K+6 


Image body 


K 



Bits per raster image point: 
Contents: 

The number B of bits used to encode references into the CLUT, thus defining a raster image point's colour. 

B shall have a value between 1 and 8. 
Coding: 

Binary. 

Number of entries in CLUT: 

Contents: 

The number C of entries in the CLUT which may be referenced from inside the image body. CLUT entries 
are numbered from to C-L 

C shall have a value between 1 and 2**B. 
Coding: 

Binary. The value shall be interpreted as 256. 

Location of CLUT: 

Contents: 

This item specifies where the CLUT for this image instance may be found. The CLUT is always located in 
the same transparent file as the image instance data themselves, at an offset determined by these two bytes. 

Coding: 

Byte 1: high byte of offset into Image Instance File. 

Byte 2: low byte of offset into Image Instance File. 

Image body: 

Coding: 

Each raster image point uses B bits to reference one of the C CLUT entries for this image instance. The 
CLUT entry being thus referenced yields the raster image point's colour. 

The image body is arrayed as for the Basic Colour Image Coding Scheme, that is, starting with the highest bit 
of the first raster image point's colour information. 
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Bytel: 



b8 b7 b 



b5 b4 b3 b2 bl 



etc 

etc 

etc 

etc 

etc 

Bit B-2 of raster point 1 GLUT reference 
Bit B-1 of raster point 1 GLUT reference 
Bit B (MSB) of raster point 1 GLUT reference 



etc. 

Unused bits shall be set to 1 . 

The CLUT (Colour Look-up Table) for an image instance with C colours is defined as follows: 

Contents: 

C CLUT entries defining one colour each. 
Coding: 

The C CLUT entries are arranged sequentially: 



Byte(s) of CLUT 


CLUT Entry 


1-3 


entry 






3*(C-1)+1 to3*C 


Entry C-1 



Each CLUT entry in turn comprises 3 bytes defining one colour in the red-green-blue colour space: 



Byte(s) of CLUT enty 


Intensity of Colour 


1 


Red 


2 


Green 


3 


Blue 



A value of 'FF' means maximum intensity, so the definition 'FF' '00' 00' stands for fully saturated red. 

NOTE 1 : Two or more image instances located in the same file can share a single CLUT. 

NOTE 2: Most MEs capable of displaying colour images are likely to support at least a basic palette of red, green, 
blue and white. 
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Annex H (normative): 

Coding of EFs for NAIVI and GSIVI-AIVIPS Operational 

Parameters 

If the EIA/TIA-553 DF is provisioned on the SIM, then EFs specified in this annex and indicated as mandatory under 
the DF shall be provided. TIA/EIA-41 [40] based radio access systems should use this DF for storage of NAM 
parameters. 

All quantities shown in the EF descriptions abide by the following rules unless otherwise specified: 

all unused bits of allocated parameters shall be set by default to 0; 

all unused bytes in a series of values (e.g. Partner, Favoured, or Forbidden SID List) should be set by default to 
'FF'. 



H.1 Elementary File Definitions and Contents 

H.1 .1 EFmin (Mobile Identification Number) 

This EF contains the Mobile Identification Number (MIN). The MIN is a 34-bit number used to address the mobile 
station across the AMPS and the TIA/EIA-136 air interfaces, and to identify the mobile station's home network. See 
TIA/EIA- 136-005 [36] for further details on MIN. 



Identifier: '4F88' 


Structure: transparent 


Mandatory | 


File size: 5 bytes 


Update Activity: low 


Access Conditions: 

READ CHV1 

UPDATE CHV2 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 -2 


MIN2 


M 


2 bytes 


3-5 


MINI 


M 


3 bytes 



The MIN field is coded as follows: 

6 most significant bits are unused; 

- next 10 bits are MIN2; 

24 least significant bits are MINI ; 

- default MIN is '00 00 00 00 00' or 'FF FF FF FF FF'. In either case the ME shall interpret this as an invalid MIN 
and shall not transmit this value over the radio interface. 



H.1.2 EF 



ACCOLC 



(Access Overload Class) 



This file contains the Access Overload Class (ACCOLC). The ACCOLC is a 4-bit indicator used to identify which 
overload class field controls the access attempts by the mobile station. See EIA/TIA-553 [41] for further details on 
ACCOLC. 
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Identifier: '4F89' 


Structure: transparent 


Mandatory | 


File size: 1 byte 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE CHV2 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1 


ACCOLC 

(possible values from '00' to 'OF') 


M 


1 byte 



Byte 1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 












L 


-^ 


-^ 


-L 


ACCOLC 
Set to 



Initial value shall be '00'. 



H.1 .3 EFs,D (System ID Of Home System) 

This file contains the system identity of the home system. The SID is a 15-bit number that uniquely identifies an AMPS 
or TIA/EIA-41 system. See EIA/TIA-553 [41] for further details on Home SID. 



Identifier: '4F80' 


Structure: transparent 


Mandatory 


File size: 2 bytes 


Update Activity: low 


Access Conditions: 

READ CHV1 
UPDATE CHV2 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1-2 


System ID of Home System (SID) 
( Most significant bit = 0) 


M 


2 bytes 



The default value shall be '0000'. 



H.1 .4 EF,pc (Initial Paging Channel) 



The Initial (First) Paging Channel contains two 1 1-bit first paging channels (FIRSTCHP p-pri and FIRSTCHP p-sec) 
used to identify the channel number of the first paging channel when the mobile station is 'home'. See EIA/TIA-553 
[41] for further details on First (Initial) Paging Channel. 
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Identifier: '4F82' 


Structure: transparent 


Mandatory | 


File size: 2-4 bytes 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE CHV2 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1 -2 


FIRSTCHPpri (Initial Paging Channel) 


M 


2 bytes 


3-4 


FIRSTCHPp-sec 





2 bytes 



In the absence of the FIRSTCHPp-sec, the mobile station shall default to '02C4' if the primary channel = '014D' 
or '02Er if the primary channel = '014E' 

A file size of 4 bytes may not be backwards compatible with the current dual-mode mobile equipment 

The default of FISRTCHPpri value shall be '014D' for A systems, or '014E' for B systems. 



H.1.5 EFop, (Group ID) 



This file defines a subset of the most significant bits of the system identification (SID) that is used to identify a group of 
cellular systems for local control purposes. If the local control option is enabled within the mobile station and the bits of 
the home system identification that comprise the group identification match the corresponding bits of the SID read by 
the mobile station over the air, then the Local Control status shall be enabled. Otherwise, the Local Control status shall 
be disabled. Refer to EIA/TIA-553 [41] for additional details. 



Identifier: '4F81' 


Structure: transparent 


Mandatory | 


File size: 1 byte 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE CHV2 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1 


Group ID 


M 


1 byte 



Group ID default value for North America = 'OA'. 

H.1 .6 EFs-ESN (SIM Electronic Serial Number) 

This file stores a 32-bit electronic serial number (ESN) that is unique to the GSM-ANSI-136 SIM. The S-ESN can be 
unrelated to the ESN of any host equipment to which the GSM-ANSI-136 SIM may be attached. The S-ESN can be 
used for registration in conjunction with the MIN. The S-ESN may also be used in conjunction with the A-key and 
CAVE algorithm for authentication. See the ANSI- 136 Usage Indicator file for details on the ESN usage indicator 
which specifies to the mobile equipment how the S-ESN should be used. See EIA/TIA-553 [41] for details on the ESN 
as it applies to registration and authentication. 

The contents of this EF shall not be changed by any over-the-air procedures. 
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Identifier: '4F8B' 


Structure: transparent 


Mandatory | 


File size: 4 bytes 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE NEVER 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1 -4 


SIM ESN 


M 


4 bytes 



Byte 1 


Byte 2 


Byte 3 


Byte 4 











Unique Serial Number 



Manufacturer Code 



The default value shall be 'FF FF FF FF'. 

H.1.7 EFcouNT (Call Count) 

This file contains the CALL COUNT parameter. The CALL COUNT is used as a simple 'clone' detector in TIA/EIA- 
136 and AMPS modes. During the network access signalling in AMPS and other TIA/EIA-41 based networks, the SIM 
reports its CALL COUNT value to the network. If the value is consistent with the network perception of the CALL 
COUNT for that SIM, then the network will likely grant access based on the authentication process. During an AMPS 
or other TIA/EIA-41 based systems call, the value of the CALL COUNT may be incremented upon a command from 
the network. The value of the CALL COUNT, when incremented, is incremented by 1 using the INCREASE command. 
See EIA/TIA-553 [41] for further details on COUNTs-p. 



Identifier: '4F83' 


Structure: Cyclic 


Mandatory | 


File size: 3*N bytes 


Update Activity: high 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


Most Recent 
Record 


CALL COUNT 


M 


3 bytes 


— 








RecN 




M 


3 bytes 



File shall be initialised '00 00 00' 
Minimum file size is 2 records 



H.1 .8 EFpsiD (Positive/Favoured SID list) 

This file contains a list of Favoured SIDs for use in identifying Favoured service providers while performing network 
selection (intelligent roaming). 
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Identifier: '4F85' 


Structure: transparent 


Optional 


File size: 2*N bytes 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE ADM 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1 -2 


Favoured SID 1 


M 


2 bytes 




Favoured SID 2 







(2N-1)-(2N) 


Favoured SID N 





2 bytes 



EOF (End of File) is indicated by 'FFFF'. An entry with all zeros is considered filler. 
The most significant bit of the Favoured SID field is not used and it is set to 0. 
Coding of the Favoured SID field (2-byte coding) 
The default value in the first two bytes shall be 'FFFF'. 
Byte 1: 



b8 b7 b6 b5 b4 b3 b2 bl 



MS bit of Favoured SID 
Set to 



Byte 2: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LS bit of Favoured SID 



H.1 .9 EFmsid (Negative/Forbidden SID List) 

This file contains a list of Forbidden SIDs, for use in identifying Forbidden service providers while performing network 
selection (intelligent roaming). 



£75/ 



3GPP TS 51.011 version 4.4.0 Release 4 



145 



ETSI TS 151 Oil V4.4.0 (2002-06) 



Identifier: '4F84' 


Structure: transparent 


Optional 


File size: 2*N bytes 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE ADM 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1 -2 


Forbidden SID 1 


M 


2 bytes 




Forbidden SID 2 







(2N-1)-{2N) 


Forbidden SID N 





2 bytes 



EOF (End of File) is indicated by 'FFFF.' An entry with all zeros is considered filler. 
The most significant bit of the Forbidden SID field is not used and it is set to 0. 
Coding of the Forbidden SID field (2-byte coding) 
The default value in the first two bytes shall be 'FFFF'. 
Byte 1: 



Byte 2: 



b8 



b8 b7 b6 b5 b4 b3 b2 b1 



b7 



b6 



b5 



b4 



b3 



b2 



b1 



MS bit of Forbidden SID 
Set to 



LS bit of Forbidden SID 



H.1 .1 EFsPL (Scanning Priority List) 



This file contains the Scanning Priority List. The Scanning Priority List is an array that defines the various types of 
systems that can be found. It also acts as a reference table, pointing to the various data structures in the SIM. This file is 
for backwards compatibility with GSM/ AMPS mobile equipment. A Mobile Station supporting both TIA/EIA-136 and 
EIA/TIA-553 [41] is not expected to support this EF for network selection. 
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Identifier: '4F87' 


Structure: transparent 


Optional 


File size: 27 bytes 


Update Activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Value 1 


M 


1 byte 


2-3 


Pointer 1 


M 


2 bytes 


















25 


Value 9 


M 


1 byte 


26-27 


Pointer 9 


M 


2 bytes 



The position of the pointers is fixed in this file. Highest priority level is 1, lowest priority level is 7. No two 
entries can have the same priority level with the exception the last two fields (Forbidden PLMNs and Negative 
SIDs) which both will have a value of 0. Default values are in parentheses. The values 1 or 2 shall reside in the 
first position (Home PLMN), and the second position (Last registered PLMN) shall contain a higher priority than 
position 3 (Preferred PLMNs List ) and 4 (Any Other PLMNs). 

Format: 



Priority Value 


Pointer 


Reserved For 


1-7 (2) 


SIM ('6F07') 


Home PLMN 


1-7 (1) 


SIM ('6F7E') 


Last Registered PLMN 


1-7 (3) 


SIM ('6F30') 


Preferred PLMNs List 


1-7 (6) 





Any Other PLMNs 


1 - 7 (4) 


SIM ('4F80') 


Home SID 


1-7 (5) 


SIM ('4F85') 


Positive SIDs List 


1 - 7 (7) 





Any Other SIDs 





SIM ('6F7B') 


Forbidden PLMNs List 





SIM ('4F84') 


Negative SIDs List 



Constraints on the Priority List: 

Mandatory PLMN priority order (highest to lowest): 

Home PLMN or Last Registered PLMN, Preferred PLMNs, Any Other PLMNs 
Mandatory SID priority order (highest to lowest): 

Home SID, Positive Sis, Any Other SIDs. 

H.1 .11 EFnetsel (Network Selection Activation Flag) 

This file contains the Network Selection Activation Flag. This flag is used to enable/disable the Manual Mode and some 
MMI functionaUty within the ME. 
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Identifier: '4F86' 


Structure: transparent 


Mandatory 


File size: 1 byte 


Update Activity: low 


Access Conditions: 








READ 




CHV1 




UPDATE 




CHV1 




INVALIDATE 




ADM 




REHABILITATE 




ADM 




Bytes 


Description 


M/0 


Length 


1 


Network Selection Activation Flag 


M 


1 byte 



Enables / disables Manual Mode and some MMI functionality within the ME, in both AMPS and GSM modes. 
Default value = 05 Hex. 
Coding: 

Bit =0 GSM Manual Mode disabled 

= 1 GSM Manual Mode enabled (default) 
Bit 1 =0 AMPS Manual Mode disabled (default) 

= 1 AMPS Manual Mode enabled 
Bit 2 =0 Scanning Sequence Flags disabled 

= 1 Scanning Sequence Flags enabled (default) 
Bit 3 =0 Disallow home only AMPS selection (default) 

= 1 Allow home only AMPS selection 
Bits 4 through 7 are not used and set to zero. 

H.1 .12 EFcsiD (Current/Last Registered SID) 

This file contains the SIDsp value. The most significant bit is unused and set to 0. 



Identifier: '4F8C' 


Structure: transparent 


Optional 


File size: 2 bytes 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE CHV1 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1 -2 


SIDsp 


M 


2 bytes 



The default value shall be 'FFFF'. 



H.1.13 EF 



REG-THRESH 



(Registration Threshold) 



This file contains the NXTREGsp value, specified in EIA/TIA-553 [41]. The three most significant bits are unused and 
are set to 0. 
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Identifier: '4F8D' 


Structure: transparent 


Optional 


File size: 3 bytes 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE CHV1 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1-3 


NXTREGsp value 


M 


3 bytes 



(Default value = '00 00 00') 



H.1 .1 4 EFcccH (Current Control Channel) 

This file contains the Current Control Channel information related to the Last Paging Control Channel on which the 
AMPS phone camped on. 



Identifier: '4F8E' 


Structure: transparent 


Optional 


File size: 2 bytes 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE CHV1 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1 -2 


Current Control Channel 


M 


2 bytes 



(Default value = '0000') 



H.1.15 EFlocc (Latest DCC) 



This file contains the DCC value associated with the saved Current Control Channel. 



Identifier: '4F8F' 


Structure: transparent 


Optional 


File size: 1 byte 


Update Activity: low 


Access Conditions: 








READ 


CHV1 






UPDATE 


CHV1 






INVALIDATE 


ADM 






REHABILITATE 


ADM 






Bytes 


Description 


M/0 


Length 


1 


DCC 
(Default value = 


'00') 


M 


1 byte 



H.1.16 EF, 



GSM-RECON 



(GSM Reconnect Timer) 



This file specifies, in seconds, the time the ME should remain scanning the GSM- 1900 spectrum, after loss of service 
from a GSM- 1900 system, before any scanning of the AMPS spectrum is allowed. 
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Identifier: '4F90' 


Structure: transparent 


Optional 


File size: 2 bytes 


Update Activity: low 


Access Conditions: 

READ CHV1 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/0 


Length 


1-2 


GSM Reconnect Timer 
(Default value = '00 3C' = 60 seconds) 


M 


2 bytes 



H.1.17 EF 



AMPS-2-GSM 



(AMPS to GSM Rescan Timing Table) 



The EF specifies, in minutes, a series of (typically increasing) intervals for scanning the GSM- 1900 spectrum, used 
while in-service on an AMPS network while in Dual-Mode operation. The time is measured from the end of the last 
GSM-1900 scan to the start of the next GSM-1900 scan. If the table is not completely filled (i.e. the end-of -table value 
'FF' is found), the last filled value may be repeated indefinitely. If a value of 'FO' is encountered, the table is terminated, 
as are all rescans to GSM until the current AMPS system is lost. 



Identifier: '4F91' 


Structure: transparent 


Optional 


File size: 10 bytes 


Update Activity: low 


Access Conditions: 

READ CHVl 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/O 


Length 


1 


First Rescan Attempt Interval (Default = '02') 


M 


1 byte 


2 


Second Rescan Attempt Interval (Default = '03') 


M 


1 byte 


3 


Third Rescan Attempt Interval (Default = '04') 


M 


1 byte 


4 


Fourth Rescan Attempt Interval (Default = '05') 


M 


1 byte 


5 


Fifth Rescan Attempt Interval (Default = '06') 


M 


1 byte 


6 


Sixth Rescan Attempt Interval (Default = 'FF') 


M 


1 byte 


7 


Seventh Rescan Attempt Interval (Default = 'FF') 


M 


1 byte 


8 


Eighth Rescan Attempt Interval (Default = 'FF') 


M 


1 byte 


9 


Ninth Rescan Attempt Interval (Default = 'FF') 


M 


1 byte 


10 


Tenth Rescan Attempt Interval (Default = 'FF') 


M 


1 byte 



H.1 .1 8 EF.FC1 (Feature Activation Codes) 

This file contains the feature code table as specified in EIA/TIA-553 [41]. 
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Identifier: '4F8A' 


Structure: transparent 


Optional 


File size: 2 bytes 


Update Activity: low 


Access Conditions: 






READ CHV1 






UPDATE ADM 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1-2 


Default value 'B990'. 


M 


2 bytes 



H.1.19 EF.MPs-u,(AMPS USAGE INDICATORS) 

This file contains usage indicators for local control and extended address method. 



Identifier: 4F93 


File Type: Transparent 


Optional 


File size: 2 bytes (minimum) 


Update Activity: Low 


Access Conditions: 






READ CHV1 






UPDATE ADM 






INVALIDATE ADM 






REHABILITATE ADM 






Bytes 


Description 


M/0 


Length 


1 


Number of Services (S) 


M 


1 byte 


2 


Services n°1 to n°8 


M 


1 byte 



-Services: 
Contents 



Service n°1 : 
Service n°2 : 

Services n3°-n°8 



Local Control Indicator (see Note 1) 

Extended Address Method indicator - included in any access attempts 

(see Note 2) 

RFU 



Number of Services 
Contents: 

This byte refers to the number of services defined in the following byte. 
Coding: 

This byte is coded as BCD 
Services 
Contents: 

This byte describes the services 
Coding: 

One bit is used to code each service 

If the bit = 0: service is not enabled 

If the bit = 1 : service is enabled 
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The bits for services not yet defined shall be set to RFU. For coding of RFU see clause 9.3. 
Byte 2: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



b1 



:Service n°1 
:Service n°2 
:Service n°3 
:Service n°4 
:Service n°5 
:Service n°6 
:Service n°7 
:service n°8 



NOTE 1 : The Local Control Indicator is a means provided within the mobile station to enable or disable the local 
control option. Local Control is a mechanism that allows a cellular system to customise operation for 
home mobile stations, and for those roaming mobile stations whose home systems are members of a 
group, by sending local orders with the order field set to local control (which informs the mobile station 
to examine the local control field), and by sending one or both of two local control global action overhead 
messages. 

A group of systems could be formed by participating systems agreeing to a common set of local control 
protocols and whose system identifications (SID) are recognised by mobile stations as a common group. 

NOTE 2: The Extended Address Method indicator determines if the extended address word must be included in all 
access attempts. 



H.2 Authentication Functionality 
H.2.1 A-KEY (ANSI-41 Authentication Key) 

The A-Key is only accessible to the algorithm used for Key generation. The A-Key may be programmed into the SIM 
directly by the service provider, or it may be programmed into the SIM through a specific over the air procedure. The 
A-Key is not accessible by the mobile equipment, therefore the method of storage on the SIM is not specified in the 
present document. The SIM command A-KEY_VALIDATION is used to store the A-Key on the SIM. 



H.2.2 SSD (Shared Secret Data) 



The Shared Secret Data is accessible only to the Authentication and the Key Generation functions. SSD is not 
accessible by the mobile equipment, therefore the method of storage on the SIM is not specified in the present 
document. 

An additional Status Code is defined for SSD updating as follows: 



98,34 



Error, Update SSD order sequence not respected (should be used if SSD Update commands are 
received out of sequence). 



H.3 Authentication commands 

It is necessary to provide six interfaces to the CAVE Algorithm and Secret Data areas, as listed below: 
Generation of Authentication Signature data, and generation of ciphering keys. 
Validation and storage of entered A-Key's 
- Ask Random task (generates R ANDES) 
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- Update Shared Secret Data (Generates SSD_A_NEW, SSD_B_NEW and AUTHBS values) 

Confirm Shared Secret Data (Updates SSD values) 

CMEA Encryption of voice channel data digits 

NOTE: For each task, the expected normal (i.e. success) status code is listed in the status word description. A list 
of possible error codes that apply to all tasks can be found in the SIM Status Codes. 

The interpretation of these instruction codes (INS in the table below) is valid only for class AO. 



Task Name 


CLA 


INS 


PI 


P2 


Lc 


Internal Authenticate 


AO' 


'88' 


'00' 


'00' 


'OF' 


AKEY validation 


AO' 


'86' 


'00' 


'00' 


'12' 


Ask Random 


AC 


'8A' 


'00' 


'00' 


'04' 


Update SSD 


'AO' 


'84' 


'00' 


'00' 


'OC 


Confirm SSD 


'AO' 


'82' 


'00' 


'00' 


'03' 


CIVIEA encrypt 


'AO' 


'8C' 


'00' 


'00' 


'nn' 



H.3.1 Generation of Authentication Signature Data and Ciphering 
Keys 

This task produces an Authentication response, and shall be used during mobile Registrations, Originations, 
Terminations, R_Data messages, SPACH Confirmations, and for the Unique Challenge-Response Procedure. If Byte 0, 
Bit 1 is set, the SIM should also generate key bits after completing the Authentication function. Some of those 
ciphering octets may be passed back to the ME for use with supplementary crypto mechanisms which reside in the ME. 
This task requires the following input parameters: 



Task Name 


CLA 


INS 


PI 


P2 


Lc 


Internal Authenticate 


'AO' 


'88' 


'00' 


'00' 


'OF' 



Coding:: 

Byte Process Control Byte 

Bit 0=RANDs, 1= RANDU 

Bit 1 Generate Key Bits flag (0= No, 1= Yes) 

Bit 2 Load Internal key flag: 

(0= pass all generated key bytes to handset, 1= load first 8 bytes of generated keys internally to SIM, 
pass all remaining key bytes to ME) 

Bits 3-7 Unused, future expansion 

Bytes 1-4 RANDs (for Registrations, Originations, and Terminations) 

or 

Bytes 1-3 RANDU (for Unique Challenge-Response Procedures) 
Byte 4 =0 (MIN2 will be filled in by SIM) 

Byte 5 Digits Length (in bits, =0, 4, 8, 12, 16, 20 or 24, 

= 4 X number of digits in bytes 6-8) 

Bytes 6-8 =0,0,0 (for Registrations, Terminations, Unique Challenge Response Procedures) 
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= Last Dialed Digits, unused bits filled with O's (for Originations). If more than 6 digits are dialed, these are 
the last 6 digits in the origination string. If less than 6 digits are dialed, MINI will be filled in by the SIM 
for the unused bits. 

Byte 9 Use ME ESN (='00') 

Bytes 10-13 ESN 

Byte 14 Key_size (=0 if Byte 0, Bit 1= 0, =8 (or more) if Byte 0, Bit 1 = 1) 

The output of this task shall be: 

Status Bytes: SWl (='9F' if success) 

SW2 (='nn' if success) 

('nn' is 03+Key_size if Byte 0, Bit 2 above =0, 03+Key_size-08 if Byte 0, Bit 2 above =1) 

H.3.2 Validation and Storage of Entered A-Key's 

With manual entry of the A-key, the input A-Key must be validated prior to its storage in the SIM. If successful, the A- 
key is saved in the SIM and the COUNTsp and Shared Secret Data (SSD) are reset to zero. This task requires the 
following input parameters: 



Task Name 


CLA 


INS 


PI 


P2 


Lc 


AKEY validation 


'AO' 


'86' 


'00' 


'00' 


'12' 



Coding: 

Bytes 0-12 

Authentication digits string (first digit in Most-Significant nibble of byte 0, last digit in Least-Significant 
nibble of Byte 12, for a total of 26 digits) 

Byte 1 3 Use ME ESN (='00') 

Bytes 14-17 ESN 

The output of this task shall be: 

Status Bytes: SWl (='90' if success) 

SW2 (='00' if success) 

H.3.3 Ask Random Task 

This task is used to generate the RANDBS random value. This task must be executed prior to updating the Shared 
Secret Data (SSD). The value RANDSeed must be generated by the ME prior to calling this task. This task requires 
the following input parameters: 



Task Name 


CLA 


INS 


PI 


P2 


Lc 


Asl< Random 


'AO' 


'8A' 


'00' 


'00' 


'04' 



Coding: 

Bytes 0-3 RANDSeed 
The output of this task shall be: 

Status Bytes: SWl (='9F' if success) 
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SW2 (='04' if success) 



H.3.4 Update Shared Secret Data 



This task is used to generate the preliminary new Shared Secret Data (SSD_A_NEW, SSD_B_NEW) and the AUTHBS 
value. The Ask Random Task (see above) must be executed prior to this routine. The task requires the following input 
parameters: 



Task Name 


CLA 


INS 


PI 


P2 


Lc 


Update_SSD 


'AO' 


'84' 


'00' 


'00' 


'OC 



Coding: 

Bytes 0-6 RANDS SD 
Byte 7 Use ME ESN (='00') 

Bytes 8-11 ESN 
The output of this task shall be: 

Status Bytes: SWl (='90' if success, ='98' if failure) 
SW2 (='00' if success, ='04' if failure) 

H.3.5 Confirm Shared Secret Data 

This task is used to validate the new Shared Secret Data (SSD_A_NEW, SSD_B_NEW) by comparing the internally 
computed AUTHBS with the AUTHBSs received from the system. If successful, the SSD_A and SSD_B values will 
be updated to match the SSD_A_NEW and SSD_B_NEW values, respectively The task requires the following input 
parameters: 



Task Name 


CLA 


INS 


PI 


P2 


Lc 


Confirm SSD 


'AO' 


'82' 


'00' 


'00' 


'03' 



Coding: 

Bytes 0-2 AUTHBSs 
The output of this task shall be: 

Status Bytes: SWl (='90' if success) 
SW2 (='00' if success) 



H.3.6 CMEA Encryption of Voice Channel Data Digits 

This task is used when the MS is on a Voice Channel, to encrypt and decrypt some portions of digital messages 
transmitted to the BS. These will occur for the following messages: 

Called Address Message (in response to a hookflash, up to 4 bytes per word, 4 words, total of 16 bytes) 



Task Name 


CLA 


INS 


PI 


P2 


Lc 


CMEA_encrypt 


'AO' 


'8C' 


'00' 


'00' 


'nn' 



where 'nn' is hex value of data length n 



Coding: 



Bytes - (n-1) The n-byte data to be encoded, max. size = 32 bytes. 
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The output of this task shall be: 

Status Bytes: SWl (='9F' if success) 

S W2 (='nn' if success) ('nn' is hex value of data length n) 

H.3.7 SIM Status Codes 

The following status codes, returned by the SIM in response to the execution of any of the tasks specified in the present 
document, are valid. The first hex value is returned in SWl, the second hex value in SW2. 

Success Codes: 

90, 00 Generic success code 

9F, XX Success, xx bytes of data available to be read via "Get_Response" task. 

Error Codes: 

92, 40 Error, memory problem 

94, 08 Error, file is inconsistent with the command 

98, 04 Error, no CHVl has been presented successfully 

98, 34 Error, Update SSD order sequence not respected (should be used if SSD Update commands are 
received out of sequence). 

67, XX Error, incorrect parameter P3 (ISO code) 

6B, XX Error, incorrect parameter PI or P2 (ISO code) 

6D, XX Error, unknown instruction code given in the command (ISO code) 

6E, XX Error, wrong instruction class given in the command (ISO code) 

6F, XX Error, technical problem with no diagnostic given (ISO code) 

6F, 00 Error, invalid input parameters to authentication computation 
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Annex I (informative): 

EF changes via Data Download or SIIVI Toolkit applications 

This annex defines if changing the content of an EF by the network (e.g. by sending an SMS), or by SIM Toolkit 
AppHcation (e.g. by using the SIM API), is advisable. Updating of certain EFs, "over the air" such as EFacc could result 
in unpredictable behaviour of the MS; these are marked "Caution" in the table below. Certain EFs are marked "No"; 
under no circumstances should "over the air" changes of these EFs be considered. 
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File identification 


Description 


Change advised 


'2F05' 


Extended Language preference 


Yes 


'2FE2' 


ICC identification 


No 


'4F20' 


Image data 


Yes 


'4Fxx' 


Image Instance data Files 


Yes 


'6F05' 


Language preference 


Yes 


'6F07' 


IMSI 


Caution (note) 


'6F20' 


Ciphering key Kc 


No 


'6F2C' 


De-personalization Control Keys 


Caution 


'6F30' 


PLMN selector 


Caution 


'6F31' 


HPLMN search period 


Caution 


'6F32' 


Co-operative network 


Caution 


'6F37' 


ACM maximum value 


Yes 


'6F38' 


SIM service table 


Caution 


'6F39' 


Accumulated call meter 


Yes 


'6F3A' 


Abbreviated dialling numbers 


Yes 


'6F3B' 


Fixed dialling numbers 


Yes 


'6F3C' 


Short messages 


Yes 


'6F3D' 


Capability configuration parameters 


Yes 


'6F3E' 


Group identifier level 1 


Yes 


'6F3F' 


Group identifier level 2 


Yes 


'6F40' 


MSISDN storage 


Yes 


'6F41' 


PUCT 


Yes 


'6F42' 


SMS parameters 


Yes 


'6F43' 


SMS status 


Yes 


'6F44' 


Last number dialled 


Yes 


'6F45' 


CBMI 


Caution 


'6F46' 


Service provider name 


Yes 


'6F47' 


Short message status reports 


Yes 


'6F48' 


CBMID 


Yes 


'6F49' 


Service Dialling Numbers 


Yes 


'6F4A' 


Extension 1 


Yes 


'6F4B' 


Extension 2 


Yes 


'6F4C' 


Extension 3 


Yes 


'6F4D' 


Barred dialling numbers 


Yes 


'6F4E' 


Extension 4 


Yes 


'6F50' 


CBMIR 


Yes 


'6F51' 


Network's indication of alerting 


Caution 


'6F52' 


GPRS Ciphering key KcGPRS 


No 


'6F53' 


GPRS Location Information 


Caution 


'6F58' 


Comparison method information 




'6F60' 


User controlled PLMN Selector with Access Technology 


see 3GPP TS 
22.011 


'6F61' 


Operator controlled PLMN Selector with Access Technology 


Caution 


'6F62' 


HPLMN Selector with Access Technology 


Caution 


'6F63' 


CPBCCH information 


No 


'6F64' 


Investigation scan 


Caution 


'6F65' 


RPLMN last used Access Technology 


No 


'6F74' 


BCCH information 


No 


'6F78' 


Access control class 


Caution 


'6F7B' 


Forbidden PLMNs 


Caution 


'6F7E' 


Location information 


No (note) 




Continued 
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File identification 


Description 


Change advised 


'6FAD' 


Administrative data 


Caution 


'6FAE' 


Phase identification 


Caution 


'6FB1' 


Voice Group Call Service 


Yes 


'6FB2' 


Voice Group Call Service Status 


Yes 


'6FB3' 


Voice Broadcast Service 


Yes 


'6FB4' 


Voice Broadcast Service Status 


Yes 


'6FB5' 


Enhanced Multi Level Pre-emption and Priority 


Yes 


'6FB6' 


Automatic Answer for eMLPP Service 


Yes 


'6FB7' 


Emergency Call Codes 


Caution 


'6FC5' 


PLMN Network Name 


Yes 


'6FC6' 


Operator PLMN List 


Yes 


'6FC7' 


Mailbox Dialling Numbers 


Yes 


'6FC8' 


Extension 6 


Yes 


'6FC9' 


Mailbox Identifier 


Caution 


'6FCA' 


Message Waiting Indication Status 


Caution 


'6FCB' 


Call Forwarding Indication Status 


Caution 


'6FCC' 


Extension 7 


Yes 


'6FCD' 


Service Provider Display Information 


Yes 


NOTE: If EFiMsi is changed, the SIM should issue REFRESH as defined in TS 11.14 [27] 
and update EFloci accordingly. 
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Annex J (informative): 

Tags defined in the present document 



Tag 


Name of Data Element 


Usage 


'A3' 


Service provider display information 
The following tags are encapsulated within 'A3': 
'80' Service provider PLIVIN list 


Service Provider Display Information 

(EFsPDi) 



NOTE: the value 'FF' is an invalid tag value. For ASN.l tag assignment rules see ISO/IEC 8825 [56] 
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Annex K (informative): 
Change history 



This annex lists all change requests approved for the present document since the first phase2+ version was approved by 
ETSI SMG. 



Meet 
ing 


Plenary 
tdoc 


WG 
tdoc 


VERS 


CR 


RV 


Rel- 
ease 


CAT 


SUBJECT 


Resulting 
Version 


s16 


709/95 


154/95 


4.15.0 


A008 




R96 


1 


SIM Speed Enhancement 


5.0.0 


s17 


062/96 


147/95 


5.0.0 


A006 




R96 


B 


Service Dialling Numbers 


5.1.0 


060/96 


06/96 


A009 




R96 


B 


ASCI for VGCS and VBS 


060/96 


06/96 


A010 




R96 


B 


ASCI for eMLPP 


059/96 


204/95r 


A013 




R96 


C 


Interaction between FDNs and ADNs 


061/96 


05/96 


A014 




R96 


D 


Correction of baud rate for SIM Speed enhancement 


s18 


263/96 


57/96 


5.1.0 


A011 


3 


R96 


B 


SIM Application Toolkit protocol enhancements 


5.2.0 


260/96 


45/96 


A016 




R96 


A 


SIM presence detection clarification 


261/96 


54/96 


A018 




R96 


A 


Reponse codes and coding of SIM service table 


262/96 


55/96 


A020 




R96 


A 


Reference to International Standards 


s19 


374/96 


102/96 


5.2.0 


A012 




R96 


C 


Contacting elements 


5.3.0 


373/96 


105/96 


A023 




R96 


A 


Clarification of clock stop timing 


409/96 


107/96 


A024 


1 


R96 


B 


Emergency Call Codes (ECC) 


374/96 


108/96 


A025 




R96 


C 


Using ranges of CBMIs 


s20 


580/96 


206/96 


5.3.0 


A021 




R96 


B 


Barred Dialling Numbers 


5.4.0 


734/96 


197/96 


A026 




R96 


B 


Addition of Cooperative Network List EF 


734/96 


197/96 


A027 




R96 


B 


Addition of ME Depersonalisation feature and EF 


702/96 


207/96 


A031 




R96 


D 


RFU bit taken into use in GSM 11.12 


s21 


101/97 


97/079 


5.4.0 


A032 


2 


R96 


D 


Ammendment to BDN diagrams in Annex B 


5.5.0 


101/97 


97/086 


A033 


1 


R96 


B 


DFs for MSS/ PCS1900/other use 


101/97 


97/056 


A034 




R96 


C 


Reading of EFDCK during SIM initialisation 


101/97 


97/058 


A036 




R96 


D 


Administrative Access Conditions 


101/97 


97/059 


A037 




R96 


B 


Format of EFCNL to include fields for Corporate Personal. Code 


101/97 


97/089 


A041 




R96 


B 


Administrative Data field 


s22 


356/97 


183/97 


5.5.0 


A042 




R97 


B 


Extended language preference 


5.6.0 


356/97 


163/97 


A044 


1 


R96 


A 


Clarification of electrical/mechanical SIM/ME interface 


356/97 


1 79/97 


A045 




R96 


D 


Security procedures for 2nd level; DFs located under DF GSM 


356/97 


187/97 


A047 




R96 


F 


Number of bytes returned after a SELECT command 


356/97 


093/97 


A048 




R96 


D 


Serivce table and "radio interface" 


356/97 


109/97 


A049 




R96 


F 


Update Access condition of EFDCK (aligns 11.11 & 02.22) 


s23 


788/97 


97/249 


5.6.0 


A046 


2 


R97 


B 


Short Message Status Reports 


5.7.0 


788/97 


97/243 


A050 




R96 


F 


Addition of SDN and BDN in the description of EFCCP 


788/97 


97/259 


A051 


1 


R97 


C 


SIM and ME behaviour when SIM is disabled and blocked 


788/97 


97/262 


A053 




R96 


F 


Response data following an ENVELOPE command 


788/97 


97/260 


A054 




R96 


F 


Coding of EFPhase 


788/97 


97/271 


A055 




R97 


C 


Changes to Dialling Number Files and extensions 


788/97 


97/261 


A056 




R97 


B 


Network's indication of alerting in the MS 


s24 


97-0886 


97/365 


5.7.0 


A052 


2 


R97 


b 


Introduction of UCS2 


5.8.0 


97-0886 


97/383 


A057 




R97 


c 


MO SMS control by SIM 


At SMG #25, it was decided to create a version 6.0.0 of every specification ttiat contained at least one release '97 work item and a 
version 7.0.0 of every specification tfiat contained at least one release '98 work item. 


s25 


98-0157 


98p052 


5.8.0 


A058 


2 


R97 


B 


Addition of EFs for GPRS 


6.0.0 


98-0157 


98p108 


A059 




R97 


F 


Clarification regarding EFCCP records 


98-0157 


98p094 


A061 


1 


R96 


A 


Clarification of removal of the SIM 


s26 


98-0398 


98p228 


6.0.0 


A062 


2 


R98 


B 


Icons - addition of EF IMG and DF GRAPHICS 


7.0.0 


98-0398 


98p227 


A064 




R98 


B 


Operation of ME with multiple card readers 


98-0400 


98p237 


A065 




R98 


F 


Deletion of all release 97 markers from the R98 version 


98-0398 


98p240 


A066 




R97 


F 


RP-ACK RP-ERROR for SIM data download error 


98-0398 


98p263 


A069 




R97 


D 


Allocation of file ID for IS-41 














(continued) 
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Change History (continued) 
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CR 
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Version 


s27 


98-0671 


98p339 


7.0.0 


A071 




R98 


c 


Enhanced image coding schemes (colour icons) 


7.1.0 


98-0671 




A072 


1 


R98 


D 


Addition of reference to PCS 1 900 


s28 


P-99-185 


9-99-076 


7.1.0 


A073 


1 


R98 


F 


Alignment with 2" edition of ISO/IEG 7816-3 (1997) 


7.2.0 


P-99-185 


9-99-037 


A074 




R98 


B 


Addition of SoLSA data fields 


P-99-185 


9-99-066 


A075 


1 


R98 


B 


Addition of CTS fields 


P-99-185 


9-99-095 


A076 


1 


R98 


B 


Definition of a file containing the title of the main menu 


P-99-185 


9-99-072 


A077 




R98 


C 


USSD format indication in the SIM Service Table 


P-99-185 


0-99-093 


A078 




R98 


B 


Informative annex on EF changes 


P-99-185 


9-99-097 


A080 




R98 


C 


Additional GPRS field 


P-99-188 




A082 




R98 


D 


Deletion of $( )$ release markers 


s29 


P-99-412 


9-99-163 


7.2.0 


A083 


1 


R98 


C 


EF IMSI changes via data download or SIM toolkit 


8.0.0 


P-99-412 


9-99-180 


A084 




R98 


F 


Addition of RUN AT COMMAND to the SIM service table 


P-99-412 


9-99-208 


A085 




R99 


C 


Alignment of maximum of records in a linear fixed file in GSM 


s30 


P-99-670 


9-99-260 


8.0.0 


A089 




R99 


A 


Correction for coding of SoLSA "Priority" field 


8.1.0 


P-99-670 


9-99-277 


A090 




R99 


D 


Clarification of the Ciphering Indicator disable bit in the EFad 


P-99-670 


9-99-281 


A091 




R99 


F 


Introduction of a new DF for the TIA/EIA-136 technology 


P-99-670 


9-99-294 


A092 


1 


R99 


B 


Addition of EF definitions under the PCS 1 900 DF 


P-99-670 


9-99-310 


A093 




R99 


F 


Clarification about "Memory Problem" error for EFloci update 


P-99-670 


9-99-300 


A094 




R99 


F 


Execution time of SIM toolkit procedures 


P-99-670 


9-99-311 


A095 




R99 


B 


Introduction of a new DF for the TIA/EIA-95 technology 


P-99-670 


9-99-258 


A097 




R99 


A 


Clarification of Optional Status for GPRS files 


s31 


P-00-137 


9-00-0088 


8.1.0 


A098 




R99 


F 


Clarification of interactions for CBS and the language files on 


8.2.0 


P-00-137 


9-00-0092 


A101 




R99 


F 


Correction to coding of ASCI EF eMLPP. 


P-00-137 


9-00-0095 


A104 




R99 


F 


Addition of coding for ASCI Efs (VGCS and VBS) 


P-00-137 


9-00-0098 


A107 




R99 


F 


Correction of the byte numbering related to EF LOCIGPRS 


P-00-137 


9-00-0133 


A108 




R99 


F 


Corrections and additions to DF-5F40 


P-00-137 


9-00-0146 


A109 


1 


R99 


F 


Clarification of manual entry of the A-Key. 


P-00-137 


9-00-0151 


Alio 




R99 


D 


Addition of reference to the File ID as used in the TETRA 


P-00-137 


9-00-0163 


A111 


1 


R99 


B 


COMPACT Cell Selection 


P-00-137 


9-00-0155 


A112 




R99 


B 


COMPACT Cell Selection - Investigation Scan indicator for 


P-00-139 


9-00-0161 


A113 




R99 


B 


Enhancement to CCP coding (CR number incorrect in P-00- 


P-00-139 


9-00-0159 


A114 




R99 


B 


Enhancement of BDN feature (CR number incorrect in P-00- 


s32 


P-00-296 


9-00-0232 


8.2.0 


A120 




R99 


B 


DFs for MExE 


8.3.0 


P-00-296 


9-00-0276 


A122 




R99 


C 


HPLM length 


P-00-296 


9-00-0275 


A123 




R99 


A 


LAI, RAI and CNL : alignment with GSM 04.08 


P-00-296 


9-00-0273 


A124 




R99 


F 


PLMN Selection Corrections regarding RFU bits 


Following the closure of ETSI SMG and the agreement of the 3GPP in July 2000 to undertake responsibility for 
remaining GSM specifications, the change requests listed below were approved by 3GPP TSG-T. This change in 
responsibility also changed the specification number from "GSM 11.11" to "3GPP TS 11.11". 


TP-09 


TP-000176 


9-00-0253 


8.3.0 


A116 




R99 


F 


PLMN Selection Corrections and additions for EDGE 


8.4.0 


TP-000176 


9-00-0269 


A119 




R99 


C 


Addition of RPLMN file 


TP-000148 


T3-000479 


A126 




R99 


F 


Standardise the current GAIT commands and reserving 


TP-11 


TP-010038 


T3-010047 


8.4.0 


A127 




R99 


F 


Addition of file ID for indicating IDEN access technology 


8.5.0 


TP-010038 


T3-010045 


A128 




R99 


F 


Correction to default HPLMN RAT 


At TSG-T #1 1 , it was agreed that all existing release 99 specifications should be reissued as release 4 specifications 
so as to create a complete set of release 4 specifications. Further more, it was agreed to change the specification 
number of all GSM-only specifications from AA.BB to (AAh-40).0BB. Thus GSM 11.11 changed to 3GPP TS 51 .01 1 . At 
the same time, the version numbering scheme was harmonised with 3G specifications so that all release 4 
specifications have a version number 4.x.y. The contents of TS 51 .01 1 v4.0.0 are identical to GSM 11.11 v8.5.0 
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Introduction of selected USIM features in to the SIM 
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EF EXT1 : Clarification of Length Indicator for Additional Data 
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Collection of corrections 


4.3.0 


TP-010244 


T3-010747 
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Alignment of SPN feature between 2G and 3G 


TP-010244 


T3-010773 


006 
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Restructuring of TS 51 .01 1 to be based on TS 102 221 


TP-010244 


T3-010797 


008 
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Correction to EF(OPL ) 


TP-14 


TP-020121 


T3-020338 
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The EFCNL and EFDCK are missed in the Figure "Files 
identifiers and directory structures of GSM" 
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The identifier of EFRPLMNAcT (RPLMN Last used Access 
Technology) is inconsistent within the specification 
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